RSS聚合摘要免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:39 AM UTC
• Version: 1.0.1

Overview

The skill is an RSS digest guide, but it relies on executing an absent, unreviewed script and includes risky setup guidance for dependencies, credentials, and cron scheduling.

Review before installing. Use this only with feed URLs you trust, avoid private or localhost/internal URLs, write output to a dedicated folder, install dependencies in a virtual environment with pinned versions, and do not place credentials in RSS URLs. Do not enable the cron example unless you understand how to inspect, disable, and contain the scheduled task.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:207

Finding

Unpinned Dependency Installation in the Global Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 207, 332, and 347
Vulnerability Type: Unpinned and insufficiently isolated third-party dependency installation
Risk Level: Medium

Relevant code snippets:

bash

pip3 install feedparser

bash

pip3 install feedparser -i https://pypi.tuna.tsinghua.edu.cn/simple

Technical Analysis

The Skill instructs users to install feedparser without specifying an exact version or verifying package hashes. The primary installation command also does not establish a virtual environment, meaning that it may modify the user's global or otherwise shared Python environment.

The alternate installation command changes the package index. Although the documented mirror is not inherently malicious, using additional package-distribution infrastructure expands the supply-chain trust boundary. Package contents could also change after this Skill has been reviewed because neither a version nor a content hash is fixed.

This finding does not establish that feedparser or the documented mirror is malicious. The vulnerability is the mutable and insufficiently isolated dependency acquisition procedure.

Attack Path

1. A user follows the installation instructions with their normal account or an elevated Python environment.
2. pip resolves the current package version and transitive dependencies from the selected index.
3. A compromised release, index, account, or dependency could supply attacker-controlled package content.
4. Package installation or later import executes attacker-controlled Python code with the privileges of the user running pip or the Skill.
5. If installed globally, the compromised component may also affect unrelated applications using the same environment.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution under the installing user's privileges. The resulting access may include reading ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

• Create and activate a dedicated virtual environment before installing dependencies.
• Pin feedparser and all transitive dependencies to reviewed exact versions.
• Supply a lock file or requirements file containing cryptographic hashes, and install with hash verification.
• Prefer the official package index unless an organization has explicitly approved and secured another repository.
• Avoid running pip as an administrator or root user.
• Document a repeatable dependency-review and update process rather than resolving mutable versions on every installation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:326

Finding

Credential Exposure Through Authentication Data Embedded in Feed URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 326
Vulnerability Type: Plaintext credentials in URLs
Risk Level: Medium

Relevant code snippet:

text

https://user:[e-mail]/feed

Technical Analysis

The documentation presents embedding a username and password directly in a feed URL as a possible method for accessing a private RSS source. It expressly states that this practice is not recommended, which reduces but does not eliminate the risk of users adopting the example.

Credentials embedded in URLs can be exposed through shell history, command-line process inspection, application logs, configuration files, proxy logs, exception output, monitoring systems, and debugging records. URL-handling components may also retain or propagate the full authority section unexpectedly.

No hardcoded real credential is present in the project. The issue is insecure credential-handling guidance rather than an exposed project secret.

Attack Path

1. A user replaces the example username and password with valid private-feed credentials.
2. The credential-bearing URL is supplied through a command line, feed-list file, or application configuration.
3. The complete URL is retained in shell history, logs, diagnostics, process metadata, backups, or monitoring infrastructure.
4. A local user, log reader, backup reader, or monitoring-system operator obtains the URL.
5. The exposed credentials are replayed against the private feed or any other service where the credentials were reused.

Impact Assessment

Exploitation could permit unauthorized access to private RSS content and any other resources protected by the same credentials. The scope is bounded by the privileges assigned to the exposed account, but credential reuse could increase the impact.

This issue does not itself provide operating-system privilege escalation. Its primary effects are confidentiality loss, unauthorized feed access, and p ...[truncated 27 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the credential-in-URL example instead of merely discouraging it.
• Use authorization headers or another feed-client authentication facility that does not place secrets in URLs.
• Retrieve credentials from an operating-system credential manager, encrypted secret store, or narrowly scoped environment injection mechanism.
• Ensure that commands, URLs, errors, and diagnostics redact authentication information.
• Use dedicated, least-privilege credentials for each feed and support prompt revocation and rotation.
• Warn users to rotate credentials if a credential-bearing URL has already appeared in shell history or logs.

T06 · System Persistence

Note

• Location: SKILL.md:306

Finding

Optional Cron Configuration Introduces Cross-Session Execution Outside the Declared Feature Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 306-310
Vulnerability Type: Scheduled cross-session execution
Risk Level: Low

Relevant code snippet:

cron

0 8 * * * cd /path/to/skill && python3 （请参考skill目录中的脚本文件） fetch --feed-file my-feeds.txt --hours 24 --output /reports/$(date +\%Y\%m\%d)-digest.md

Technical Analysis

The documentation provides a cron expression that would execute the Skill every day at 08:00. This produces cross-session persistence because execution continues without an interactive Skill invocation and survives terminal or agent-session termination.

The persistence mechanism is user-configured and is not installed automatically by the package. It also supports a reasonable daily-digest use case. However, it exceeds the minimum privileges and lifecycle needed for one-time RSS aggregation, and it conflicts with the capability table and limitation text that declare scheduled automation unsupported.

The project contains no executable script to which the placeholder command can be resolved. Consequently, the code that would eventually run on the schedule cannot be reviewed in this package. If the referenced directory or script is later replaced or modified, cron will execute the modified content automatically with the cron owner's privileges.

Attack Path

1. A user adapts the example and adds it to their crontab.
2. The cron service retains the task and invokes it daily under the user's account.
3. The referenced Skill directory or script is subsequently modified, replaced, or made writable by another party.
4. At the next scheduled time, cron executes the altered script without further confirmation.
5. The altered code receives the filesystem and network access available to the cron owner.

The supplied Skill does not itself perform steps 1 or 3, so this is a persistence-risk pattern rather than evidence of a covert backdoor.

Impact Assessment

A co ...[truncated 457 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the cron workaround or explicitly classify scheduling as a separate, external, opt-in integration.
• Do not imply that the free edition lacks scheduling while simultaneously directing users to establish scheduled execution.
• Require explicit user confirmation before any scheduled task is created.
• Provide installation, inspection, disabling, and removal instructions for the cron entry.
• Execute only a reviewed script at an absolute, immutable path.
• Restrict write access to the Skill directory, feed-list file, and invoked script.
• Run the task under a dedicated least-privilege account rather than root.
• Use a restricted output directory and avoid inheriting unnecessary secrets or environment variables.
• Add bounded timeouts, failure logging, and rate limits for network retrieval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill performs network fetches from user-supplied feed URLs and can write output to local files, but the documentation does not clearly foreground these side effects near the usage entry points. In an agent context with exec enabled, insufficient disclosure increases the risk of SSRF-like internal URL access, unintended outbound requests, or silent filesystem writes when users think they are only generating a summary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L082-L083 the document explicitly states '不支持定时自动化调度'. However, L306-L311 provides a cron-based automatic scheduling setup for the skill, which directly contradicts the earlier claim that scheduling is unsupported. This is an intent/documentation contradiction rather than a mere omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L145-L149 says the skill is not suitable for several scenarios, but L151-L153 then states it should be used when '需要数据分析、报表生成、统计洞察、数据可视化时使用'. That guidance contradicts both the surrounding 'not suitable' section and the manifest's declared purpose of lightweight RSS aggregation and summary generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L151-L153 将触发条件描述为“需要数据分析、报表生成、统计洞察、数据可视化时使用”，这类表述覆盖面很广，远超该技能实际宣称的 RSS/Atom 抓取、过滤与摘要范围。缺少明确触发短语、边界条件和负例，容易让代理在普通数据分析请求下误调用此技能。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Advising users to embed credentials directly in RSS URLs promotes plaintext secret handling in command arguments, config files, shell history, logs, and agent transcripts. In this skill's context, where execution and file-based workflows are encouraged, such credentials could be retained, echoed, or exposed to other tools and users, leading to account compromise or unauthorized feed access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

该技能的显示名、摘要和主体说明均固定为中文，且文档中未说明是否支持其他语言或允许用户选择输出/交互语言。对于面向通用 Agent 平台的技能，若隐含强制特定语言而无用户选择，可能构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The cron example encourages repeated unattended execution and automatic file writes without warning about persistence, log growth, file overwrite behavior, or accumulation of sensitive content in generated reports. In an agent/exec environment, this can normalize unattended scheduled writes and network access in ways users may not fully appreciate.

Content

No source excerpt is available for this finding.