Security audit

AI Trend Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI news monitoring and Feishu notification tool, with some implementation/documentation mismatches but no evidence of hidden or malicious behavior.

Before installing, confirm that the Feishu webhook URLs point only to recipients you intend to notify, and treat the current code as a prototype because it uses mock search data and only the scheduled summary path performs an actual webhook POST.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises continuous monitoring across multiple external platforms and automatic pushing of collected content to Feishu webhooks, but the description does not clearly warn users about ongoing outbound data collection and transmission. This can mislead users about the operational scope of the skill, increasing the chance that it is deployed without informed consent, appropriate review of monitored sources, or understanding that third-party content will be forwarded externally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring at L118-L121 describes a function that searches and extracts specific URLs, implying active retrieval from a real search source. In reality, lines L123-L167 define fixed mock results and L167-L172 only transform those local constants, so the code does not perform search behavior at all.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring at L216-L218 states this function performs a direct realtime push, and lines L235-L236 also describe calling a message-sending API in deployment. However, the actual implementation at L237-L239 only prints the constructed message to stdout and never sends it to any webhook or messaging API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code performs outbound POST requests to configurable webhook endpoints without any user-facing disclosure, approval step, or data-classification guard. In an agent-skill context, this can silently exfiltrate collected content to third-party endpoints, especially if the webhook environment variable is misconfigured or attacker-controlled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill description, setup guidance, and operational instructions are presented in Chinese, which effectively imposes a language requirement on users. There is no indication that other languages are supported or that the Chinese-only presentation is an intentional, documented constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes the locale zh-CN when formatting output timestamps, which enforces a specific language/locale choice for user-visible content. The file does not provide a user option to select locale or document that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes the locale zh-CN when formatting output timestamps, which enforces a specific language/locale choice for user-visible content. The file does not provide a user option to select locale or document that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes the locale zh-CN when formatting output timestamps, which enforces a specific language/locale choice for user-visible content. The file does not provide a user option to select locale or document that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes the locale zh-CN when formatting output timestamps, which enforces a specific language/locale choice for user-visible content. The file does not provide a user option to select locale or document that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ai_trend_monitor.js:18