Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent AI-news collector, but its WebUI credential handling and custom feed fetching create security issues users should review before installing.
Review this skill before installing. It should be run in a limited workspace, with pinned dependencies and only trusted feed URLs. Avoid entering a Twitter bearer token into the WebUI until token storage and DOM injection issues are fixed; prefer environment variables or a backend secret store. Use cron only if you intentionally want scheduled background collection.
webui/app.js:340Persistent DOM XSS in Custom Source Rendering
${source.description || '自定义RSS订阅源'}
webui/app.js:223Twitter Bearer Token Persisted in Plaintext Browser Storage
scripts/parsers/blog_rss.py:55Arbitrary RSS URL Fetching Enables Server-Side Request Forgery
references/sources_guide.md:173Extension Guidance Forwards API Secrets to Unrestricted Configured URLs
SKILL.md:148Unpinned Third-Party Dependency Installation
templates/morning_report.md:7Untrusted Remote Content Is Emitted into Markdown Without Structural Escaping
scripts/parsers/arxiv.py:39arXiv Metadata Retrieved over Cleartext HTTP
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
声明描述的是一个端到端的“AI情报哨兵”系统，应侧重于采集AI领域最新动态、多源整合分析与报告生成。而实际代码块仅是 quality_scorer.py，其核心能力是对已经存在的报告数据进行质量评分：统计条目数量与内容长度、解析发布时间评估时效性、统计来源/类型/话题多样性、根据Markdown结构评估可读性，并输出星级、评级和Markdown评分卡。它不包含数据采集、外部源访问、情报监测、自动分析生成报告等与声明主用途相符的核心行为。虽然“报告质量评分”可以作为整个系统的辅助组件，但就该代码块本身而言，其实际行为与声明的主要用途存在明显偏差。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
bearer_token = os.environ.get("TWITTER_BEARER_TOKEN", "")
- 或创建 `config/secrets.yaml`（已加入.gitignore）：
```yaml
twitter:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
bearer_token = os.environ.get("TWITTER_BEARER_TOKEN", "")
- 或创建 `config/secrets.yaml`（已加入.gitignore）：
```yaml
twitter:
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
🔧 **kpjadhav94/python-for-embedded**
Python Language for Embedded Engineer...
⭐0 Stars | Python
🔧 **modern-python/spellchecks**
Python library for spell-checking text i...
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
🔧 **kpjadhav94/python-for-embedded**
Python Language for Embedded Engineer...
⭐0 Stars | Python
🔧 **modern-python/spellchecks**
Python library for spell-checking text i...
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</head>
<body>
<div class="app">
<!-- 侧边栏 -->
<aside class="sidebar">
<div class="logo">
<span class="logo-icon">⌘</span>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</div>
</div>
<!-- ==================== 配置视图 ==================== -->
<div class="view" id="settingsView">
<div class="settings-group">
<h3>API配置</h3>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 编辑 crontab
crontab -e
# 添加以下内容
0 8 * * * cd /path/to/ai-sentinel && python scripts/collect.py --all && python scripts/reporter.py --type morning
The README tells users to place a Twitter/X Bearer Token into configuration or the WebUI but does not warn that this is a sensitive credential, should not be committed to source control, and should be stored securely. In a project centered on automated collection and reporting, users are likely to persist credentials in plain YAML files or browser-managed UI state, increasing the chance of accidental exposure via repos, backups, logs, or shared hosts.
The skill declares powerful tools (shell, filesystem, http) and describes network collection plus writing reports to disk, but it does not define an explicit scope such as permissions or allowed-tools. This creates an overbroad execution surface where the agent may perform file and network actions beyond what users clearly expect, increasing the chance of unintended data access or persistence.
The skill name, description, triggers, and usage instructions are all presented in Chinese, implying a fixed language/locale experience. There is no opt-in, user choice, or documented justification that this is a region-specific tool, so the file reflects a natural-language locale constraint without accommodation.
The trigger list includes broad phrases like AI资讯, AI动态, 晨报, and 晚报, which can match ordinary conversation and cause the skill to activate unintentionally. Because the skill has shell, filesystem, and HTTP capabilities, accidental activation could trigger external requests and local file writes without sufficiently explicit user intent.
The skill description highlights reporting features but does not clearly warn users that it collects data from external sources and writes generated reports to disk. This weakens informed consent and can lead to privacy, compliance, or operational issues if users do not realize network access and local persistence will occur.
This manifest/config file contains natural-language comments and source names primarily in Chinese, which imposes a specific language context without any user opt-in or justification that the skill is intended only for Chinese-speaking users. Under the policy, forcing a language or locale without choice or documented necessity is a natural-language policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
1. 检查Bearer Token是否正确
2. 确认开发者账号状态正常
3. 检查API配额是否用尽
4. 查看 [Twitter API Status](https://api.twitterstat.us/)
### GitHub API 403错误
Suspicious Unicode normalization or mixed-script content
The file presents the report entirely in Chinese from the title onward, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Section headers, labels, and generated summaries across the report are in Chinese, but the file does not mention any language preference setting or locale-specific scope. This can violate language policy when users are not offered a choice or informed of a justified locale limitation.
This markdown file is entirely written as a Chinese-language report and presents the content in a fixed locale/style without any indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
The module title and user-facing descriptions are written entirely in Chinese, and the command-line interface messages also assume Chinese-language interaction. The policy requires flagging language or locale constraints when a skill forces a specific language without opt-in, and this file contains no indication that users may choose another language or that the Chinese-only behavior is region-specific.
The module docstring and all user-facing documentation/comments are written exclusively in Chinese, including the stated capability description. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language constraint that is not documented as region-specific or optional.
This code file contains natural-language descriptions and output strings in Chinese, including the module docstring and later user-visible messages, but it does not provide any user opt-in or indicate that the skill is intentionally limited to Chinese-speaking users. That can violate a language/locale policy requiring user choice or explicit justification for a fixed language.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
since = (datetime.now() - timedelta(days=30)).strftime("%Y-%m-%d")
date_filter = f" created:>{since}"
url = "https://api.github.com/search/repositories"
params = {
"q": query + date_filter,
"sort": "stars",
Detected: suspicious.exposed_secret_literal