Ai Capsule

• Outcome: Review
• Latest audit: Jun 25, 2026 · 6:54 AM UTC
• Version: 1.0.5

Overview

The skill is a coherent AI news digest tool, but its default daily run reads local Chrome X/Twitter session cookies and passes them to a subprocess without a clear per-run opt-in.

Install only if you are comfortable with a daily news skill using your logged-in Chrome x.com session to fetch posts. Review the X/Twitter source list first, consider removing or disabling that source if you do not want cookie access, and be aware that cookies are passed to twitter-cli along with the process environment and any detected local proxy settings.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell, network access, environment variables, and local file read/write, yet no explicit permissions are declared. This creates a consent and transparency gap: an agent or user may invoke a skill that can access local config files, browser-derived credentials, and persistent storage without an upfront permission model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The documented purpose is news ranking, but the skill also exposes repository-modifying and publishing workflows plus source-configuration mutation. That mismatch broadens the effective attack surface: a user expecting a read-mostly digest tool could be induced into running commands that alter local files or publish content remotely.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "daily" is extremely broad and likely to appear in normal conversation, increasing the chance of unintended skill activation. In an agent environment that can fetch remote content, read local configuration, access browser-derived X/Twitter cookies indirectly via its tooling, and write persistent local state, accidental invocation expands the attack surface and may cause network actions or local data access the user did not intend.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The usage section advertises "daily" as a standalone activation phrase without constraints, examples of safe/non-safe invocation, or explicit confirmation requirements. Because this skill performs external fetching and maintains local persistent data, ambiguous invocation can lead to unintended execution, including network requests and updates to history/dedup files.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to invoke the skill with the single word "daily", which is a highly generic phrase that can easily appear in ordinary conversation. In an agent runtime that auto-matches skills from natural-language input, this broad trigger can cause unintended activation, leading the skill to fetch external content, read local browser cookies for x.com, probe localhost proxy ports, and write local state without the user explicitly intending to run this skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation table documents "daily" and its Chinese equivalent as standalone activation phrases, again without boundaries or exclusion conditions. Given this skill's capabilities, accidental invocation is more concerning than a typical read-only skill because execution may trigger network access, subprocess execution, local proxy auto-detection, and access to x.com cookies from the local Chrome profile.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs reading local Chrome x.com cookies and invoking a Twitter-fetch subprocess, but that sensitive behavior is easy to miss in operational steps. Access to browser cookies can expose authenticated session material, making this far more sensitive than ordinary web fetching, especially when combined with subprocess execution and optional proxy use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads authentication cookies from the user's local Chrome profile and forwards them to a subprocess, enabling use of an active X/Twitter session without an explicit just-in-time consent prompt. In this skill's context, that is especially sensitive because browser cookies are high-value credentials and delegating them to another tool expands the trust boundary.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

Dedup file: `{data_dir}/dedup-titles.txt` (one title per line).

**Daily mode**: handled centrally in `sections/daily-mode.md` Step 3 — never judge manually.

**Single / URL / Batch mode**:

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return []

    # 3. 逐账号抓取
    env = os.environ.copy()
    env["TWITTER_AUTH_TOKEN"] = auth_token
    env["TWITTER_CT0"] = ct0

• Confidence: 89% confidence
• Finding: Copying the full process environment and then passing it into a subprocess can leak unrelated secrets from the parent environment to twitter-cli and its dependencies. In this skill, that risk is amplified because sensitive browser-derived auth tokens are also added to the child environment, increasing the blast radius if the subprocess is compromised, logs environment data, or invokes further tools.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"  X/Twitter @{handle}...")
            try:
                # 多拉一些确保时间过滤后还能拿到目标条数
                result = subprocess.run(
                    [_twitter_bin, "user-posts", f"@{handle}", "--max", "20"],
                    capture_output=True, text=True, timeout=20, env=env
                )

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Self-Modification

High

• Category: Rogue Agent

Content

read -r -p "版本号 [$NEXT]: " INPUT
VERSION="${INPUT:-$NEXT}"

# ── Update SKILL.md version ──
sed -i '' "s/^version: .*/version: $VERSION/" SKILL.md
echo "SKILL.md → version: $VERSION"

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Known Vulnerable Dependency: requests==2.32.4 — 1 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency specification permits installation of requests 2.32.4, which is identified by the scanner as affected by CVE-2026-25645. Even though this issue is limited to Requests' extract_zipped_paths() helper and may only be reachable if the skill or one of its dependencies processes attacker-controlled ZIP-related paths, pinning or allowing a known vulnerable version is still a real supply-chain weakness. In this skill's context, the tool fetches untrusted remote content from many sources, so retaining a known-vulnerable HTTP library is unnecessary risk, though the practical impact appears low.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

| `type: rss` | fetch.py (Step 1) | Done |
| `type: webfetch`, `python_fetch: true` | fetch.py (Step 1) | Done, `content` field populated |
| `type: webfetch`, `python_fetch: false` (Product Hunt) | Claude `WebFetch` | Cloudflare — must use WebFetch |
| `type: twitter` | fetch.py (Step 1) | Reads x.com cookies from local Chrome, auto-detects proxy |
| `type: tavily` | Claude Tavily search | Reddit etc. |

Skip a source on failure — do not block on it. **Use dates in article titles, body text, or page ordering to determine whether an article falls within the cutoff date; skip old articles immediately.**

• Confidence: 93% confidence
• Finding: This skill explicitly instructs the daily run to read x.com cookies from the user's local Chrome profile and pass them to a subprocess (`twitter-cli`). Even if described as in-memory only, accessing browser session cookies is a sensitive credential-handling pattern that can enable account/session compromise if the subprocess, environment, logs, proxy path, or downstream tooling are malicious or mishandled.

Static analysis

No suspicious patterns detected.