Security audit

Daily CEO Briefing Generator

Security checks for vulnerabilities and agentic risk

Overview

This news-briefing skill is mostly coherent, but it has review-worthy risks from broad scraping, arbitrary URL fetching, external LLM submission, and under-disclosed credential access.

Review this skill before installing. Use it only in an environment where broad web fetching is acceptable, avoid running it with access to internal network services, provide only narrowly scoped API keys, and prefer pinned dependencies or a reviewed commit. Be aware that generated reports may send fetched article content to MiniMax or OpenRouter and that the default briefings are Chinese-language with opinionated source selection.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_news.py:29
Finding: Server-Side Request Forgery Through Untrusted Article URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_ceo_briefing.py:252
Finding: Indirect Prompt Injection Through Untrusted News and Article Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rss_parser.py:86
Finding: TLS Certificate Verification Disabled for All RSS Requests
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/generate_ceo_briefing.py:12
Finding: Excessive and Undocumented Access to a Workspace-Wide Credential File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Remote Installation and Runtime Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (67)

Tainted flow: 'OPENROUTER_API_KEY' from os.getenv (line 21, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/github_cache.py (reported line 103)May include surrounding context.
python
只输出分析内容，不要其他废话。""" try: response = requests.post( OPENROUTER_API_URL, headers={ "Authorization": f"Bearer {OPENROUTER_API_KEY}",

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill also performs systematic source testing, subprocess execution, directory cleanup/creation, and QA report generation while being presented as an end-user briefing skill, then it has undeclared operational capabilities that can modify the filesystem and orchestrate other scripts. That is a real security concern because hidden maintenance/test behaviors can be triggered unexpectedly and cause unintended file changes or broaden execution scope.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Accessing a shared workspace .env file constitutes credential access behavior because the skill reaches into a general secret store rather than receiving only the minimum secret it needs. In a broader agent environment, this pattern can normalize over-privileged secret exposure and make unrelated credentials available to code paths that should not see them.
Content: Scanner excerpt · scripts/generate_ceo_briefing.py (reported line 15)May include surrounding context.
python
SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) REPORTS_DIR = os.path.join(SKILL_DIR, "reports") ENV_FILE = "/home/ubuntu/.openclaw/workspace/.env" MINIMAX_API_HOST = "https://api.minimaxi.com" M2_MODEL = "MiniMax-M2.1"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly advertises anti-bot bypass and full-content scraping via Playwright/Cloudflare evasion, but gives no warning about legal, privacy, or terms-of-service implications. In an agent context, this can normalize automated collection from sites that did not consent, increasing the chance of policy violations, IP blocking, or collection of sensitive content at scale.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills from an unpinned remote package, which allows whatever version is current at install time to execute on the user's machine. That creates a supply-chain risk: a compromised upstream package, dependency, or later malicious release could run arbitrary code during installation or skill setup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language triggers are broad and open-ended, making it unclear when the skill should activate versus when the agent should avoid autonomous fetching. In agent environments, ambiguous triggers can cause over-broad web access, unexpected scraping, or execution of expensive/high-risk behaviors from casual user phrasing.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and invokes local scripts that perform network access, filesystem reads/writes, shell execution, and likely environment-variable use, but the manifest does not declare any tool scope or permissions boundaries. This creates a least-privilege failure: a reviewer or runtime may not realize the skill can fetch arbitrary content, write reports locally, and launch subprocesses, increasing the chance of overbroad execution and abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and primary documentation are written entirely in Chinese and describe the skill behavior as producing a briefing in that language/style, but they do not indicate that users can choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s title and task instructions are written entirely in Chinese and direct the model to operate in that language, but they do not offer the user any language choice or opt-in. Under the policy, forcing a specific language without user selection is a natural-language locale violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file title explicitly frames the skill as an "AI 深度日报" and the output specification requires a report format that includes translated titles, indicating a fixed Chinese-language/localized presentation. There is no indication that the user can choose language or that the locale restriction is justified as region-specific, which conflicts with the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file explicitly requires the summary to be written 'in Chinese', and the title/header also presents the skill as a Chinese-language briefing. This is a natural-language locale policy issue because it imposes a specific language without user opt-in or any stated regional/compliance justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly forces inclusion of ideologically specific sources and themes in a generic news briefing workflow. This creates systematic viewpoint steering unrelated to the stated core function of aggregating and summarizing daily news, which can bias outputs and undermine trust in neutrality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Requiring at least two items from named left-wing or independent outlets, even when it exceeds normal selection limits, is a strong output-manipulation mechanism. It can override editorial relevance and cause the briefing to privilege a predetermined political framing, which is risky for a broadly described news skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L126 states 'Simplified Chinese throughout' as a blanket requirement. Under the policy rule, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown instruction mandates bilingual/Chinese section labels such as "热门项目", "核心价值", and "启发思考" in the generated report. Because the file does not offer the user any language preference or explain a justified locale requirement, it violates the language/locale policy constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and required output format are entirely in Chinese, including a fixed Chinese briefing title and Chinese section structure. This imposes a specific language/locale on the skill's behavior without any opt-in, fallback, or documented regional justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file introduces a dedicated social/political analysis workflow that goes beyond the stated manifest scope of producing a CEO-style tech/AI daily briefing from defined sources. Scope expansion in agent skills is risky because it can cause the agent to process sensitive political content, apply editorial biasing rules, and generate outputs the user and operator did not explicitly authorize.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.