每日毛选文章推送

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:46 PM UTC
• Version: 9.0.2

Overview

This skill does what it says: it generates Mao Zedong article notes, writes them locally, and can send them to Telegram, with no artifact-backed evidence of deception or unrelated data access.

Install only if you are comfortable with generated content being sent to your configured Telegram chat and saved under the configured Obsidian directory. Test first with --chat or --no-send, confirm TELEGRAM_CHAT_ID points to the intended private chat, and enable cron only after verifying the output.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares required binaries, env vars, and dependent skills, but it does not declare permissions despite clearly documenting capabilities that read environment variables, write files to an Obsidian path, access the network for Telegram and AI APIs, and invoke commands for cron setup and Python execution. Missing permission declarations weaken user consent and platform policy enforcement, making it easier for a user or runtime to underestimate the skill's access to local data, outbound communication, and shell execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose emphasizes daily article generation and Telegram/Obsidian delivery, but the file also references optional image generation via an external dependent skill, an additional API key, and subprocess execution. This behavior expansion is security-relevant because external skill invocation and subprocess usage increase the attack surface and can surprise users who did not expect third-party execution paths or extra outbound API usage.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The script advertises chat mode as 'output only' with no save/push side effects, but it still calls get_today_article() before the chat-mode branch, which writes to .article-state. This is dangerous because operators may rely on chat mode for side-effect-free previews or testing and unknowingly alter persistent state, affecting later runs and audit expectations.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The file behavior materially differs from the skill's declared purpose: it generates quote images via an external image-generation workflow instead of performing daily article push, deep interpretation, Obsidian generation, or Telegram delivery. This mismatch can mislead users and reviewers about the permissions, data flows, and capabilities actually exercised by the skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script dynamically locates and executes an external sub-skill script from several user-controlled filesystem locations. For a skill presented as article delivery, this expands capability into arbitrary external image generation and introduces trust in code outside the reviewed package, increasing supply-chain and execution risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script reads a dedicated API key and prepares an environment for an external image-generation service even though that capability is not disclosed by the skill description. In context, the danger is less about reading a secret per se and more about undisclosed credential use and hidden expansion of external networked behavior.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README documents automatic Telegram delivery and local Obsidian file creation, but it does not clearly foreground that the skill performs recurring outbound transmission and scheduled file writes. In an automation context, weak disclosure can lead users to enable the skill without fully understanding where generated content is sent or what is being persisted locally.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script reads Telegram credentials from environment variables and transmits generated content to an external service without an explicit interactive confirmation, dry-run default, or prominent operator warning. In an agent/skill context, this can cause unintended data egress to a third party if the skill is invoked automatically or with unexpected content, especially because the outbound behavior is built into normal execution.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.