Agent2RSS - AI Content to RSS Feed

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:16 PM UTC
• Version: 0.2.1

Overview

This skill is mostly coherent for publishing content to Agent2RSS, but it has review-worthy credential and content exposure risks in dry-run output and remote HTTP use.

Review this skill before installing. Use it only with a trusted HTTPS Agent2RSS server, avoid remote http:// endpoints, do not run DRY_RUN with real channel tokens or private content, and treat the local config file as sensitive because it stores channel bearer tokens.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent2rss.sh:68
• Finding: Dry-run mode exposes bearer tokens and submitted content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent2rss.sh:68-74`; sensitive call sites at `scripts/agent2rss.sh:176-179`, `197-200`, `217-220`, and `241-244` **Vulnerability Type**: Sensitive information exposure through diagnostic output **Risk Level**: Medium ### Vulnerable Code ```bash http_call() { if [ "${DRY_RUN:-0}" = "1" ]; then echo "[DRY_RUN] curl $*" return 0 fi curl "$@" } ``` Authenticated operations pass secrets and content directly to this function. For example: ```bash http_call -fsS -X POST "$(channel_posts_url "$cid")" \ -H "Authorization: Bearer $token" \ -H 'Content-Type: application/json' \ -d "$data" ``` ### Technical Analysis The dry-run implementation serializes every `curl` argument using `$*` without redacting sensitive values. Arguments can include: - `Authorization: Bearer ...` headers containing reusable channel tokens. - Complete JSON article bodies and associated metadata. - Idempotency keys. - Local paths of files selected for upload. Although dry-run mode does not transmit the request, it prints the complete authentication material and payload to standard output. Standard output is frequently retained in CI logs, agent transcripts, terminal capture systems, debugging records, or centralized log platforms. Because the exposed bearer token is sufficient for authenticated channel operations, this is more than informational metadata leakage. ### Attack Path 1. A user or automated workflow enables the documented `DRY_RUN=1` mode to preview an operation. 2. The workflow invokes `update-channel`, `push-file`, or `push-json`. 3. The operation passes its bearer token and request data to `http_call`. 4. `http_call` prints every argument without sanitization. 5. A user, process, CI participant, or log-system operator with access to the captured output obtains the token. 6. The exposed token is reused to update the associated channel or publish content through the Agent2RSS API. ### Impact ...[truncated 511 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never print raw `curl` argument arrays when they may contain credentials or request bodies. - Replace bearer token values with a fixed marker such as `Authorization: Bearer [REDACTED]`. - Omit or summarize values supplied through `-d`, `--data`, `--data-binary`, and `-F`. - Redact local upload paths if paths may contain sensitive names. - Implement dry-run output as structured data containing only: - HTTP method. - Sanitized destination URL. - Content type. - Names of submitted fields. - Payload size or file size. - Ensure tests verify that representative tokens and article content never appear in dry-run output. - Rotate any channel tokens that may already have been captured in logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent2rss.sh:44
• Finding: Authenticated operations permit remote plaintext HTTP connections<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent2rss.sh:44-61`; authenticated requests at `scripts/agent2rss.sh:172-179`, `190-200`, and `229-244` **Vulnerability Type**: Plaintext transmission of credentials and sensitive content **Risk Level**: Medium ### Vulnerable Code ```bash warn_if_remote_or_insecure() { local url=$1 case "$url" in http://127.0.0.1*|http://localhost*|https://127.0.0.1*|https://localhost*) ;; http://*) echo "⚠️ 警告：你正在使用非 HTTPS 的远程地址：$url" >&2 echo " 建议改为 HTTPS，或使用你信任的自部署实例。" >&2 ;; https://*) echo "ℹ️ 当前使用远程服务：$url" >&2 echo " 请确认该服务由你信任的主体维护。" >&2 ;; *) echo "serverUrl 必须是 http/https" >&2 exit 1 ;; esac } ``` The warning is followed by authenticated requests such as: ```bash http_call -fsS -X POST "$(channel_upload_url "$cid")" \ -H "Authorization: Bearer $token" \ -F "file=@$file" \ -F "idempotencyKey=$key" ``` ### Technical Analysis The URL validation function detects remote `http://` endpoints but only displays a warning. Execution continues, and subsequent channel updates or post uploads transmit bearer tokens and content without transport encryption. HTTP does not provide confidentiality or endpoint authentication. A network-positioned attacker can observe credentials and content or modify requests and responses in transit. This exposure may occur on untrusted wireless networks, compromised routers, corporate proxies, shared hosting networks, or through DNS and routing manipulation. The use of `curl -f` does not mitigate this issue because it only handles HTTP error responses and does not add transport security. ### Attack Path 1. The configuration file or `SERVER_URL` environment variable is set to a remote `http://` endpoint. 2. The user invokes an authenticated operation such as `update-channel`, `push-file`, or `push-json`. 3. The script emits a warning but does not stop execution. 4. The bearer token and su ...[truncated 894 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Reject remote `http://` endpoints instead of merely warning. - Allow plaintext HTTP only for validated loopback destinations such as `127.0.0.1`, `::1`, and `localhost`. - Require an explicit, high-friction override if non-loopback HTTP must be supported for exceptional development environments. - Ensure the override clearly states that credentials and content will be transmitted without encryption. - Prefer HTTPS with normal certificate and hostname verification; do not introduce `curl -k` or equivalent verification bypasses. - Validate `SERVER_URL` with a proper URL parser where available, including host and scheme checks. - Consider rejecting URLs containing user information, fragments, unexpected control characters, or ambiguous host representations. - Rotate tokens that have previously been sent over remote plaintext HTTP. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/agent2rss.sh:160
• Finding: Channel names and descriptions are interpolated into JSON without encoding<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent2rss.sh:160` and `scripts/agent2rss.sh:176-179` **Vulnerability Type**: Improper construction of JSON requests **Risk Level**: Low ### Vulnerable Code Channel creation constructs JSON through direct string interpolation: ```bash resp=$(http_call -fsS -X POST "$sv/api/channels" -H 'Content-Type: application/json' -d "{\"name\":\"$name\",\"description\":\"$desc\"}") ``` Channel updates use the same pattern: ```bash http_call -fsS -X PUT "$sv/api/channels/$cid" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $token" \ -d "{\"name\":\"$name\",\"description\":\"$desc\"}" ``` ### Technical Analysis The `name` and `desc` variables are inserted directly into a JSON string. JSON-sensitive characters—including double quotes, backslashes, newlines, and other control characters—are not escaped. This does not directly create shell command injection because the variables are expanded inside shell double quotes and are ultimately passed as arguments. However, it allows malformed JSON and may permit manipulation of the logical request structure. For example, attacker-controlled input containing quotes and JSON delimiters could attempt to terminate the intended string and introduce additional properties. The exact effect of duplicate or injected properties depends on the remote server's JSON parser and validation rules. At minimum, legitimate names or descriptions containing special characters can reliably cause request failure. ### Attack Path 1. An untrusted source controls or influences a channel name or description supplied to the script. 2. The value includes JSON metacharacters such as quotes, backslashes, or structural delimiters. 3. The script inserts the value into the request body without JSON encoding. 4. The resulting body is malformed or contains an altered JSON structure. 5. The server either rejects the request, interprets unintended fields, or applies parser-d ...[truncated 818 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct JSON with a JSON-aware encoder rather than string interpolation. Since `jq` is already a required dependency, use it consistently: ```bash local payload payload=$(jq -n \ --arg name "$name" \ --arg description "$desc" \ '{name: $name, description: $description}') resp=$(http_call -fsS -X POST "$sv/api/channels" \ -H 'Content-Type: application/json' \ --data-binary "$payload") ``` Apply the same construction method to `update_channel`. Additional hardening should include: - Validate reasonable maximum lengths for channel names and descriptions. - Reject prohibited control characters if the server does not support them. - Use `--data-binary` to avoid unintended processing differences. - Add tests covering quotes, backslashes, newlines, Unicode text, empty descriptions, and JSON-looking input. - Retain server-side schema validation because client-side encoding alone does not enforce allowed fields or value constraints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises shell-based operation (`bash`, `curl`, `jq`, and `scripts/agent2rss.sh`) but does not declare an explicit tool scope such as `permissions` or `allowed-tools`. That means an agent may invoke shell/network-capable actions without a clear policy boundary, increasing the risk of unintended command execution, filesystem access, and outbound requests to a configurable remote server.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description is broad enough that ordinary mentions of RSS, channels, uploading articles, or default-channel setup could activate the skill in situations where the user did not intend remote publishing behavior. In this skill's context, accidental activation is more dangerous because the documented commands can create channels, upload files, and send content to a remote `serverUrl`, potentially exposing local content or causing unauthorized external side effects.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 1. 创建频道
请求
```bash
curl -X POST https://agent2rss.yaotutu.top:8765/api/channels \
  -H "Content-Type: application/json" \
  -d '{"name":"技术博客","description":"分享技术文章和教程"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples instruct users to send article content, uploaded files, and bearer tokens to a remote third-party server, but they do not warn that this transmits potentially sensitive data off-platform. In an agent skill context, users may paste private content or reuse privileged tokens without understanding the privacy and security implications, increasing the risk of unintended data disclosure.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

}

ensure_secure_perms() {
  chmod 600 "$CONFIG_FILE" 2>/dev/null || true
}

warn_if_remote_or_insecure() {

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The example response sets `language` to `zh-CN`, and the document overall presents the API as using Chinese locale values without stating that this is merely illustrative or optional. The policy requires avoiding forced language/locale behavior unless the user is given a choice or the regional constraint is clearly documented.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: Multiple response examples repeat `language: "zh-CN"`, which can imply a fixed locale expectation for the skill or service. Because the file does not mention alternative locales or explain that the service is intentionally China-specific, this is a natural-language locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The update response example includes `language: "zh-CN"` but the surrounding documentation never tells users whether they can choose another language. Repeated fixed-locale examples across the document can amount to a policy issue when no user choice or justification is provided.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-examples.md:41