基金新闻日报

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:57 PM UTC
• Version: 1.2.1

Overview

This fund-news skill has a coherent purpose, but it tells the agent to automatically install unpinned third-party dependencies, including a global npm package, without asking the user first.

Install only if you are comfortable with the agent modifying your environment. Prefer manually installing reviewed, pinned versions in an isolated environment, and do not let the skill run global npm or ambient pip installs without explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Automatic Installation of Unpinned Third-Party Dependencies## Vulnerability Details **File Location**: `SKILL.md:19-38`; duplicated in `references/query_rules.md:14-18` and `references/technical_specs.md:3-9` **Vulnerability Type**: Supply-chain exposure through automatic, unpinned dependency installation **Risk Level**: Medium **Vulnerable commands:** ```bash agent-browser --version npm install -g agent-browser python -c "import docx" pip install python-docx ``` ### Technical Analysis The Skill instructs the agent to install the latest available versions of `agent-browser` and `python-docx` automatically when they are not already present. It does not specify approved versions, package hashes, lockfiles, trusted registry configuration, or package-signature verification. The `agent-browser` package is installed globally with npm. Global installation expands the affected environment beyond this Skill and may execute npm package lifecycle scripts with all privileges held by the invoking user. The Python package is also installed into whichever environment the unqualified `pip` command selects. This does not establish that either named dependency is currently malicious. The vulnerability is that the Skill automatically trusts mutable third-party releases without integrity controls or explicit user approval. ### Attack Path 1. An attacker compromises the relevant package registry account, publishing pipeline, package distribution infrastructure, or a future dependency release. 2. The attacker publishes a package version containing malicious installation or runtime behavior. 3. A user invokes the Skill in an environment where the dependency is absent. 4. Following `SKILL.md` and `references/technical_specs.md`, the agent runs the unpinned installation command. 5. The package manager downloads the current compromised release. 6. Malicious package lifecycle or runtime code executes with the permissions of the user running the agent. ### Impact Assessment Successful exploit ...[truncated 657 chars]
• Remediation: ## Remediation Suggestions 1. Pin every dependency to a specifically reviewed version rather than installing the latest release. 2. Maintain lockfiles and verify package integrity with registry-provided hashes or an internal artifact manifest. 3. Install Python dependencies into a dedicated virtual environment using `python -m pip`, not an ambiguous global `pip` executable. 4. Install npm dependencies locally in an isolated project directory rather than using `npm install -g`. 5. Disable or carefully review npm lifecycle scripts where operationally possible. 6. Configure approved registries explicitly and prevent dependency resolution from untrusted mirrors or indexes. 7. Require explicit user confirmation before modifying the environment. 8. Prefer a prebuilt, reviewed runtime image containing the required dependency versions. 9. Periodically audit pinned packages and update them through a controlled review process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fund_news_word.py:181
• Finding: Predictable DOCX File Creation in a Shared Temporary Directory## Vulnerability Details **File Location**: `scripts/fund_news_word.py:181-184` **Vulnerability Type**: Predictable temporary path and symlink-following file write **Risk Level**: Medium **Vulnerable code:** ```python start_date = datetime(2026, 3, 10) end_date = datetime(2026, 3, 10) output_path = f'/tmp/{get_filename(start_date, end_date)}' result = generate_word_document(news_data, start_date, end_date, output_path) ``` The resulting output path is deterministic. For the embedded dates, it resolves to a fixed filename under the shared `/tmp` directory. The document is subsequently written at `scripts/fund_news_word.py:148`: ```python doc.save(output_path) ``` ### Technical Analysis The direct-execution path creates a report using a predictable filename in the shared `/tmp` directory. The code does not securely create the destination with exclusive semantics, inspect it for symbolic links, verify ownership, or place it inside a private per-user directory. On systems where `/tmp` is writable by multiple users, an attacker can prepare the expected destination before the victim runs the script. If the underlying document-writing operation follows a symbolic link, the victim's process writes DOCX content to the link target. The vulnerable fixed-path behavior is in the script's `__main__` example. The reusable `generate_word_document` function accepts a caller-supplied output path and therefore is not intrinsically restricted to `/tmp`; exploitation of this specific issue requires execution through the included direct-execution path or equivalent caller behavior. ### Attack Path 1. A local attacker determines the predictable report name from the hardcoded dates and `get_filename()` format. 2. The attacker creates `/tmp/20260310-20260310基金新闻.docx` as a symbolic link to a file writable by the intended victim. 3. The victim executes `scripts/fund_news_word.py`. 4. `generate_word_document()` calls `doc.save(output ...[truncated 813 chars]
• Remediation: ## Remediation Suggestions 1. Avoid fixed filenames in globally writable directories. 2. Use `tempfile.TemporaryDirectory` or `tempfile.NamedTemporaryFile` in a private, permission-restricted location. 3. Create the destination atomically with exclusive-create semantics so an existing path causes a safe failure. 4. If a stable final filename is required, first generate the document in a securely created temporary file and then move it atomically into a user-owned output directory. 5. Reject symbolic links and verify the destination's ownership and file type immediately before replacement. 6. Allow the user to select an output directory and default to a private documents or application-data directory rather than `/tmp`. 7. Do not run the report generator with elevated privileges. 8. Add tests that pre-create the destination as a symbolic link and confirm that document generation fails safely without modifying the target.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to check for and automatically install global system and Python dependencies (`npm install -g agent-browser`, `pip install python-docx`) during normal use. This exceeds the narrow scope of a news-query skill and creates a supply-chain and environment-modification risk, especially because package installation executes code from external registries and alters the host without explicit user approval.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that the AI will automatically install dependencies on first use and explicitly says the user does not need to install them manually, but it does not require consent or warn that this modifies the system. That behavior can surprise users, violate least-privilege expectations, and enable unintended execution of third-party install scripts or persistent system changes.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Line L07 lists trigger words for '今日新闻' as '今日', '今天', and '默认'. '今天' is common everyday speech and '默认' is especially ambiguous because it suggests fallback activation without a clearly bounded condition, which could cause unintended skill invocation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The document is entirely written as mandatory Chinese-language instructions, including required output behavior such as line L52-L55, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains operation to a specific language without documented opt-in or justification.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The spec instructs the agent to automatically install global dependencies via `npm install -g` and `pip install` at first use, which expands the skill from passive news retrieval into modifying the host environment. This creates unnecessary supply-chain and environment-integrity risk, especially if package resolution is unpinned or runs in a privileged context.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and later user-visible strings indicate the skill is designed to operate only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language content, examples, and outputs are all presented in Chinese, which effectively forces a single language experience. The file does not indicate that users may choose another language or that the locale restriction is an intentional, documented regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This markdown file is written entirely as a required formatting standard in Chinese and specifies Chinese-language output elements such as '基金新闻.docx' and Chinese source labels, but it does not state that the language requirement is optional or limited to a China-specific workflow. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.