Agent2RSS - AI Content to RSS Feed

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:16 PM UTC
• Version: 0.2.1

Overview

This skill is mostly coherent for publishing content to Agent2RSS, but it has review-worthy credential and content exposure risks in dry-run output and remote HTTP use.

Review this skill before installing. Use it only with a trusted HTTPS Agent2RSS server, avoid remote http:// endpoints, do not run DRY_RUN with real channel tokens or private content, and treat the local config file as sensitive because it stores channel bearer tokens.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent2rss.sh:68

Finding

Dry-run mode exposes bearer tokens and submitted content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent2rss.sh:44

Finding

Authenticated operations permit remote plaintext HTTP connections

Content

View full analysis

&2 echo " 建议改为 HTTPS，或使用你信任的自部署实例。" >&2 ;; https://*) echo "ℹ️ 当前使用远程服务：$url" >&2 echo " 请确认该服务由你信任的主体维护。" >&2 ;; *) echo "serverUrl 必须是 http/https" >&2 exit 1 ;; esac } ``` The warning is followed by authenticated requests such as: ```bash http_call -fsS -X POST "$(channel_upload_url "$cid")" \ -H "Authorization: Bearer $token" \ -F "file=@$file" \ -F "idempotencyKey=$key" ``` ### Technical Analysis The URL validation function detects remote `http://` endpoints but only displays a warning. Execution continues, and subsequent channel updates or post uploads transmit bearer tokens and content without transport encryption. HTTP does not provide confidentiality or endpoint authentication. A network-positioned attacker can observe credentials and content or modify requests and responses in transit. This exposure may occur on untrusted wireless networks, compromised routers, corporate proxies, shared hosting networks, or through DNS and routing manipulation. The use of `curl -f` does not mitigate this issue because it only handles HTTP error responses and does not add transport security. ### Attack Path 1. The configuration file or `SERVER_URL` environment variable is set to a remote `http://` endpoint. 2. The user invokes an authenticated operation such as `update-channel`, `push-file`, or `push-json`. 3. The script emits a warning but does not stop execution. 4. The bearer token and su ...[truncated 894 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/agent2rss.sh:160

Finding

Channel names and descriptions are interpolated into JSON without encoding

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises shell-based operation (bash, curl, jq, and scripts/agent2rss.sh) but does not declare an explicit tool scope such as permissions or allowed-tools. That means an agent may invoke shell/network-capable actions without a clear policy boundary, increasing the risk of unintended command execution, filesystem access, and outbound requests to a configurable remote server.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description is broad enough that ordinary mentions of RSS, channels, uploading articles, or default-channel setup could activate the skill in situations where the user did not intend remote publishing behavior. In this skill's context, accidental activation is more dangerous because the documented commands can create channels, upload files, and send content to a remote serverUrl, potentially exposing local content or causing unauthorized external side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 14)May include surrounding context.

1. 创建频道

请求

bash

curl -X POST https://agent2rss.yaotutu.top:8765/api/channels \
  -H "Content-Type: application/json" \
  -d '{"name":"技术博客","description":"分享技术文章和教程"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples instruct users to send article content, uploaded files, and bearer tokens to a remote third-party server, but they do not warn that this transmits potentially sensitive data off-platform. In an agent skill context, users may paste private content or reuse privileged tokens without understanding the privacy and security implications, increasing the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/agent2rss.sh (reported line 43)May include surrounding context.

sh

}

ensure_secure_perms() {
  chmod 600 "$CONFIG_FILE" 2>/dev/null || true
}

warn_if_remote_or_insecure() {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example response sets language to zh-CN, and the document overall presents the API as using Chinese locale values without stating that this is merely illustrative or optional. The policy requires avoiding forced language/locale behavior unless the user is given a choice or the regional constraint is clearly documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Multiple response examples repeat language: "zh-CN", which can imply a fixed locale expectation for the skill or service. Because the file does not mention alternative locales or explain that the service is intentionally China-specific, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The update response example includes language: "zh-CN" but the surrounding documentation never tells users whether they can choose another language. Repeated fixed-locale examples across the document can amount to a policy issue when no user choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-examples.md:41