RSS阅读器免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

This RSS skill is not overtly malicious, but it needs review because it asks for shell/npm execution while the reviewed package does not include the Node.js script it tells users to run.

Review before installing. Use an isolated project directory, prefer the official npm registry with pinned dependencies, inspect or supply the missing Node.js script before allowing exec, and do not add the crontab example unless you intentionally want a recurring local task writing reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:204

Finding

Unpinned npm Dependencies and Use of an Alternate Package Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 204, 359, and 374–375
Vulnerability Type: Supply-chain exposure through mutable dependency resolution and an alternate registry
Risk Level: Medium

Vulnerable Code Snippets

At line 204:

bash

npm install xml2js node-fetch

At line 359:

bash

npm install xml2js node-fetch --registry https://registry.npmmirror.com

At lines 374–375:

text

| xml2js | npm package | Required | npm install xml2js |
| node-fetch | npm package | Required | npm install node-fetch |

Technical Analysis

The installation instructions do not pin reviewed dependency versions and the project contains no package manifest or lockfile that records exact versions and integrity hashes. Consequently, the packages and their transitive dependencies resolved at installation time may differ from those reviewed during the audit.

The troubleshooting guidance also directs users to an alternate npm registry. Although using a mirror is not inherently malicious, it adds another supply-chain trust boundary. If the registry, a package publisher account, a resolved package version, or a transitive dependency is compromised, npm may download attacker-controlled content.

Standard npm installation can execute package lifecycle scripts. Therefore, a malicious dependency release could run code during installation without requiring the user to invoke the RSS reader afterward. The audited project contains only SKILL.md; the referenced implementation, dependency manifest, and lockfile are absent, so dependency compatibility and integrity cannot be verified.

Attack Path

1. A user follows the Skill's setup instructions and runs one of the documented npm install commands.
2. npm resolves the latest dependency versions because no versions or lockfile are specified.
3. An attacker compromises a package publisher, a transitive dependency, or the recommended alternat ...[truncated 1196 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed package.json that pins exact dependency versions rather than relying on mutable latest releases.
2. Generate and commit a package-lock.json containing resolved versions and integrity hashes.
3. Replace the documented installation command with npm ci, which installs the locked dependency graph and fails when the manifest and lockfile disagree.
4. Use npm ci --ignore-scripts when dependency lifecycle scripts are unnecessary. If scripts are required, document and review each required script explicitly.
5. Prefer the official npm registry. If an alternate mirror must be supported, document its trust implications and require integrity or provenance verification.
6. Run npm audit, review transitive dependencies, and use automated dependency monitoring before publishing updates.
7. Include the referenced implementation in the package so reviewers can verify how xml2js and node-fetch are used and whether both dependencies are actually necessary.
8. Perform dependency installation under a non-administrative account and in an isolated project directory or container to reduce the impact of a compromised package.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions say the skill should be used for generating marketing copy, writing content, title optimization, and general content creation, which is materially broader than an RSS reader/research tool. In an agent setting, overly broad triggers can cause the skill to activate in unrelated contexts and steer the agent into using exec-backed behavior when a safer, non-executing workflow would suffice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest and document present the skill name and user-facing description entirely in Chinese, but there is no indication that the skill is region-specific or that users can opt into another language. This can violate language/locale policy when a skill implicitly forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs shell execution and output redirection to local files (for example writing reports via > and using cron-style automation) without clearly warning that commands will execute on the host and modify filesystem state. In agent environments, missing effect disclosures increase the risk of surprising file writes, unintended overwrites, or unsafe automation being performed without informed user consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a lightweight RSS/Atom reader focused on subscription management, filtering, and summarization. Line L395 expands the operational capability into general network diagnostic command execution, which is not a direct or necessary part of the skill’s stated end-user purpose and relies on broader shell access than the RSS workflow itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.