基金新闻日报

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:57 PM UTC
• Version: 1.2.1

Overview

This fund-news skill has a coherent purpose, but it tells the agent to automatically install unpinned third-party dependencies, including a global npm package, without asking the user first.

Install only if you are comfortable with the agent modifying your environment. Prefer manually installing reviewed, pinned versions in an isolated environment, and do not let the skill run global npm or ambient pip installs without explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-38; duplicated in references/query_rules.md:14-18 and references/technical_specs.md:3-9
Vulnerability Type: Supply-chain exposure through automatic, unpinned dependency installation
Risk Level: Medium

Vulnerable commands:

bash

agent-browser --version
npm install -g agent-browser

python -c "import docx"
pip install python-docx

Technical Analysis

The Skill instructs the agent to install the latest available versions of agent-browser and python-docx automatically when they are not already present. It does not specify approved versions, package hashes, lockfiles, trusted registry configuration, or package-signature verification.

The agent-browser package is installed globally with npm. Global installation expands the affected environment beyond this Skill and may execute npm package lifecycle scripts with all privileges held by the invoking user. The Python package is also installed into whichever environment the unqualified pip command selects.

This does not establish that either named dependency is currently malicious. The vulnerability is that the Skill automatically trusts mutable third-party releases without integrity controls or explicit user approval.

Attack Path

1. An attacker compromises the relevant package registry account, publishing pipeline, package distribution infrastructure, or a future dependency release.
2. The attacker publishes a package version containing malicious installation or runtime behavior.
3. A user invokes the Skill in an environment where the dependency is absent.
4. Following SKILL.md and references/technical_specs.md, the agent runs the unpinned installation command.
5. The package manager downloads the current compromised release.
6. Malicious package lifecycle or runtime code executes with the permissions of the user running the agent.

Impact Assessment

Successful exploit ...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a specifically reviewed version rather than installing the latest release.
2. Maintain lockfiles and verify package integrity with registry-provided hashes or an internal artifact manifest.
3. Install Python dependencies into a dedicated virtual environment using python -m pip, not an ambiguous global pip executable.
4. Install npm dependencies locally in an isolated project directory rather than using npm install -g.
5. Disable or carefully review npm lifecycle scripts where operationally possible.
6. Configure approved registries explicitly and prevent dependency resolution from untrusted mirrors or indexes.
7. Require explicit user confirmation before modifying the environment.
8. Prefer a prebuilt, reviewed runtime image containing the required dependency versions.
9. Periodically audit pinned packages and update them through a controlled review process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fund_news_word.py:181

Finding

Predictable DOCX File Creation in a Shared Temporary Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/fund_news_word.py:181-184
Vulnerability Type: Predictable temporary path and symlink-following file write
Risk Level: Medium

Vulnerable code:

python

start_date = datetime(2026, 3, 10)
end_date = datetime(2026, 3, 10)
output_path = f'/tmp/{get_filename(start_date, end_date)}'

result = generate_word_document(news_data, start_date, end_date, output_path)

The resulting output path is deterministic. For the embedded dates, it resolves to a fixed filename under the shared /tmp directory. The document is subsequently written at scripts/fund_news_word.py:148:

python

doc.save(output_path)

Technical Analysis

The direct-execution path creates a report using a predictable filename in the shared /tmp directory. The code does not securely create the destination with exclusive semantics, inspect it for symbolic links, verify ownership, or place it inside a private per-user directory.

On systems where /tmp is writable by multiple users, an attacker can prepare the expected destination before the victim runs the script. If the underlying document-writing operation follows a symbolic link, the victim's process writes DOCX content to the link target.

The vulnerable fixed-path behavior is in the script's __main__ example. The reusable generate_word_document function accepts a caller-supplied output path and therefore is not intrinsically restricted to /tmp; exploitation of this specific issue requires execution through the included direct-execution path or equivalent caller behavior.

Attack Path

1. A local attacker determines the predictable report name from the hardcoded dates and get_filename() format.
2. The attacker creates /tmp/20260310-20260310基金新闻.docx as a symbolic link to a file writable by the intended victim.
3. The victim executes scripts/fund_news_word.py.
4. generate_word_document() calls `doc.save(output ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid fixed filenames in globally writable directories.
2. Use tempfile.TemporaryDirectory or tempfile.NamedTemporaryFile in a private, permission-restricted location.
3. Create the destination atomically with exclusive-create semantics so an existing path causes a safe failure.
4. If a stable final filename is required, first generate the document in a securely created temporary file and then move it atomically into a user-owned output directory.
5. Reject symbolic links and verify the destination's ownership and file type immediately before replacement.
6. Allow the user to select an output directory and default to a private documents or application-data directory rather than /tmp.
7. Do not run the report generator with elevated privileges.
8. Add tests that pre-create the destination as a symbolic link and confirm that document generation fails safely without modifying the target.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to check for and automatically install global system and Python dependencies (npm install -g agent-browser, pip install python-docx) during normal use. This exceeds the narrow scope of a news-query skill and creates a supply-chain and environment-modification risk, especially because package installation executes code from external registries and alters the host without explicit user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that the AI will automatically install dependencies on first use and explicitly says the user does not need to install them manually, but it does not require consent or warn that this modifies the system. That behavior can surprise users, violate least-privilege expectations, and enable unintended execution of third-party install scripts or persistent system changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L07 lists trigger words for '今日新闻' as '今日', '今天', and '默认'. '今天' is common everyday speech and '默认' is especially ambiguous because it suggests fallback activation without a clearly bounded condition, which could cause unintended skill invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document is entirely written as mandatory Chinese-language instructions, including required output behavior such as line L52-L55, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains operation to a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The spec instructs the agent to automatically install global dependencies via npm install -g and pip install at first use, which expands the skill from passive news retrieval into modifying the host environment. This creates unnecessary supply-chain and environment-integrity risk, especially if package resolution is unpinned or runs in a privileged context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and later user-visible strings indicate the skill is designed to operate only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language content, examples, and outputs are all presented in Chinese, which effectively forces a single language experience. The file does not indicate that users may choose another language or that the locale restriction is an intentional, documented regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file is written entirely as a required formatting standard in Chinese and specifies Chinese-language output elements such as '基金新闻.docx' and Chinese source labels, but it does not state that the language requirement is optional or limited to a China-specific workflow. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.