信息源监控助手

• Outcome: Review
• Latest audit: May 28, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

This monitoring skill mostly matches its purpose, but it needs review because it can send monitored content to external services and may save an LLM API key locally without clear warning.

Review before installing if your monitored sources may include private, internal, or proprietary content. Prefer environment variables over entering API keys into setup, verify the LLM base URL and Feishu webhook destination, avoid webhook delivery for sensitive digests, and periodically clean local state and ~/info-digest files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes capabilities that require network access, environment variable use, and local file read/write, but it does not declare any permissions. This weakens user consent and platform enforcement because the agent may access external services and persist data locally without an explicit, reviewable permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior does not fully match the implemented behavior: it omits local Markdown persistence, includes monetization/license logic, and claims DingTalk support that is not actually implemented. This is dangerous because users may approve or invoke the skill under false assumptions about data handling, storage, and outbound integrations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The license activation logic accepts any key beginning with "CNIM-", making authorization trivial to bypass. While this does not directly compromise the host, it defeats access control/business logic and indicates hidden functionality not disclosed in the skill description, which increases risk in an agent ecosystem.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This section implements local quota enforcement and plan activation unrelated to the stated feed-monitoring purpose, and the protection is weak enough to be bypassed by editing the JSON state file or supplying a prefixed key. In context, the hidden gating logic is more concerning because users would not expect the skill to persist licensing state or enforce opaque execution limits.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The authorization scheme is effectively non-existent: any key with a hardcoded prefix, and especially the universal key `CNIM-FREE-UNLOCK`, upgrades the user to `pro` with only local state changes. This makes the protection trivially bypassable and undermines any trust in license state, which can also normalize insecure local-only authorization patterns in a broader system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill does not clearly warn users that monitored content may be sent to external LLM services and written to local files. This creates a privacy and data handling risk because article contents, user-selected sources, or summaries may leave the local environment or be stored on disk without sufficiently explicit notice.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code transmits article titles and content to a third-party LLM endpoint, which can expose sensitive, proprietary, or personal data if the monitored sources contain such information. In this skill context, automatic aggregation increases risk because users may assume summarization is local while the implementation silently performs network exfiltration to a configurable external service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.