Security audit

AI News Digest (中文版)

Security checks for vulnerabilities and agentic risk

Overview

The news-digest skill itself is coherent, but its install paths can execute or install mutable remote code/instructions without verification.

Review this skill before installing, especially the install commands. Prefer manual installation of the reviewed SKILL.md or a pinned, checksum-verified release instead of curl | bash, irm | iex, unpinned npm, or installers that fetch main-branch content. Expect the skill to fetch public web sources and create or update files under the configured ai-news output directory.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:25
Finding: Installation instructions execute mutable remote scripts without verification
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:9
Finding: Installers activate a mutable remote Skill file without integrity validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:39
Finding: Documentation invokes unpinned third-party npm packages
Content: View full analysis
``` ### Technical Analysis Neither command pins a reviewed package version. `npm install -g` installs the registry's currently resolved release globally, while `npx` may download and immediately execute the current package version. The repository does not provide a lockfile, integrity hash, signature, or provenance verification for these installation paths. Therefore, the code users execute may change independently of this Skill package. This creates exposure to compromised maintainer accounts, malicious package updates, npm registry supply-chain incidents, and unexpected behavior introduced by future releases. Global installation also increases the persistence and scope of the installed dependency compared with a project-local invocation. ### Attack Path 1. An attacker compromises an npm maintainer account or publishes a malicious update through another supply-chain failure. 2. The unpinned package name resolves to the malicious release. 3. A user follows the command in `README.md`. 4. npm downloads the malicious package and its dependencies. 5. Package lifecycle scripts or CLI entry points execute with the user's privileges. 6. The package can access resources available to the user and modify Agent configuration or other local files. ### Impact Assessment A malicious npm package or lifecycle script executes with the invoking user's privileges. Potential impact includes: - Modification of user-level files and Agent configuration. - Theft of environment variables, package tokens, or accessible credentials. - Installation of additional dependencies or persistence. - Execution of arbitrary commands. - Broader system mo ...[truncated 196 chars]
Remediation: View remediation
` and `agent-skills-cli@`. 2. Prefer project-local installation over global installation. 3. Publish and verify npm integrity metadata or signed provenance for approved package versions. 4. Use `npx --package=@` or an equivalent version-pinned invocation. 5. Disable lifecycle scripts during installation where they are not required, then explicitly run only reviewed entry points. 6. Document package ownership and the exact versions tested with this Skill. 7. Periodically review pinned dependencies and update them through a controlled security-review process. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash construct is the dangerous execution step that converts remote content retrieval into immediate shell execution. In the context of a skill README, this is especially risky because users are likely to copy-paste installation commands verbatim, making any upstream compromise directly actionable on endpoints.
Content: Scanner excerpt · README.md (reported line 25)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://raw.githubusercontent.com/yan1sanjin/ai-news-digest/main/install.sh | bash

Windows (PowerShell):

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The README also recommends curl ... | bash from unpkg.com, a CDN-backed third-party source, which compounds supply-chain risk because users execute unaudited remote code immediately. If the package, CDN response, or upstream account is compromised, attackers can run arbitrary commands during installation.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
或用 skill-atlas-cli 装 (ClawHub 中文版 CLI / 虾小宝):

bash
# macOS / Linux curl -fsSL https://unpkg.com/skill-atlas-cli/install.sh | bash skill-atlas install ai-news-digest-cn # Windows (PowerShell)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This second | bash example has the same arbitrary-code-execution risk, with additional third-party hosting exposure through unpkg.com. The skill context does not justify such an unsafe install pattern, and including it in the README normalizes insecure operator behavior.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
或用 skill-atlas-cli 装 (ClawHub 中文版 CLI / 虾小宝):

bash
# macOS / Linux curl -fsSL https://unpkg.com/skill-atlas-cli/install.sh | bash skill-atlas install ai-news-digest-cn # Windows (PowerShell)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是技能运行时的业务功能：抓取 AI 新闻并生成中文 Markdown 日报。但提供的代码块仅是 install.sh 安装器，其主要作用是检测 Claude Code 环境、创建技能目录、通过 curl 下载远程 SKILL.md，并输出安装后的使用提示。该代码没有实现新闻抓取、内容汇总、中文生成或日报写入桌面等核心功能。因此，代码实际行为与声明目的存在明显不一致，属于材料性目的不匹配。
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using curl ... | bash removes any review boundary between download and execution, so any tampering, repository compromise, or unexpected content is executed immediately in the user's shell. Even though the script body here is simple, the documented install pattern normalizes unsafe chaining and materially increases exploitation risk.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash # ai-news-digest skill installer (Claude Code) # Usage: curl -fsSL https://raw.githubusercontent.com/yan1sanjin/ai-news-digest/main/install.sh | bash set -e

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README repeatedly describes the skill as generating a Chinese-friendly or Chinese daily digest, but it does not indicate that users can choose another output language. This is a natural-language policy concern because it forces a specific language behavior without explicit user opt-in or a documented locale-specific justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
md
复制 `SKILL.md` 到对应 agent 的 skills 目录: **Claude Code**: - macOS / Linux: `~/.claude/skills/ai-news-digest/SKILL.md` - Windows: `%USERPROFILE%\.claude\skills\ai-news-digest\SKILL.md` **OpenClaw**:

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 72)May include surrounding context.
md
复制 `SKILL.md` 到对应 agent 的 skills 目录: **Claude Code**: - macOS / Linux: `~/.claude/skills/ai-news-digest/SKILL.md` - Windows: `%USERPROFILE%\.claude\skills\ai-news-digest\SKILL.md` **OpenClaw**:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises broad natural-language triggers like '今天有什么 AI 新闻', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. Because the skill writes local files and fetches external content, accidental invocation can lead to unintended network access and file modification in routine chats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes update mode that overwrites an existing daily report and archives the old version, but it does not present a prominent upfront warning that local files will be modified automatically in some modes. In non-interactive contexts, defaulting to update behavior increases the chance of silent data modification when the skill is triggered unintentionally or via automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says the skill activates on phrases like “生成今日 AI 日报” or “今天有什么 AI 新闻”等指令, where the “etc.” leaves the trigger set open-ended and one listed phrase is close to normal conversational requests about news. Because the manifest does not provide explicit exclusion conditions or a bounded trigger list, the activation scope is ambiguous and could cause unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description states the skill generates a Chinese markdown daily report, and later instructions require Chinese summaries and confirmations by default. This enforces a specific language/locale behavior without indicating that the user can choose another language or opt in to Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is entirely presented in Chinese and labels translated titles with "[中文译]", indicating the skill produces a Chinese-language digest by default. There is no indication in this file that users can choose another language or that the Chinese-only output is required for a justified region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file consistently presents translated Chinese output, and the explicit "[中文译]" labeling indicates a language-specific presentation. There is no visible user opt-in, alternative language option, or stated region-specific requirement, which can violate language/locale policy for skills that should not force a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation examples and described output are presented as Chinese-only, including the required prompt phrase 生成今日 AI 日报 and output conventions such as **[中文译]**. The file does not indicate that users may choose another language, which can violate language/locale policy when a specific language is imposed without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installer explicitly documents execution via irm ... | iex, which downloads and immediately executes remote PowerShell code without prior integrity verification, review, or pinning. This creates a supply-chain risk: if the GitHub account, repository, branch, or network path is compromised, users may run attacker-controlled code on their machine.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The README instructs users to fetch and immediately execute a remote shell script from GitHub via curl ... | bash. This pattern gives the remote content full code-execution capability on the user's machine at install time, and any compromise of the repository, branch, hosting path, or transport chain can turn installation into arbitrary command execution.
Content: Scanner excerpt · README.md (reported line 25)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://raw.githubusercontent.com/yan1sanjin/ai-news-digest/main/install.sh | bash

Windows (PowerShell):

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language content is fully in Chinese, including headings, summaries, and metadata, and there is no indication that users can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language locale concern unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file states that generated output will be written to ~/Desktop/ai-news/YYYY-MM-DD.md, which is a user-data-affecting file write. Although the behavior is documented, there is no clear warning or cautionary disclosure that the skill creates or updates files on disk, which is the kind of operational side effect SQP-2 asks markdown files to surface.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The installer explicitly promotes fetching and executing remote content from GitHub, which creates a supply-chain risk: if the remote script or hosting account is compromised, users may run attacker-controlled code immediately. In the skill context this is more dangerous because the installation path targets a local agent/skill directory, making users more likely to trust and execute setup commands without inspection.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash # ai-news-digest skill installer (Claude Code) # Usage: curl -fsSL https://raw.githubusercontent.com/yan1sanjin/ai-news-digest/main/install.sh | bash set -e

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script instructs users to invoke the skill using the Chinese phrase "生成今日 AI 日报". This imposes a specific language in user-facing guidance without any opt-in or alternative, which matches the policy category for language/locale constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.