Ai News Skills

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:54 PM UTC
• Version: 1.3.1

Overview

This is a disclosed AI-news automation skill, but it uses mutable installation steps and persistent self-updating behavior that need review before use.

Install only after reviewing the shell installer and using a pinned, trusted agent-reach version. Use a least-privilege Feishu app limited to the intended tables/docs, avoid broad chat or wiki tokens, disable implicit invocation and cron until tested, and require human approval before watch_chains.md or analysis_framework.md changes are applied.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:10

Finding

Unpinned Third-Party Dependency Is Downloaded and Immediately Executed

Content

View full analysis

Checking Agent Reach ..." if command -v agent-reach &>/dev/null; then echo " agent-reach already installed, skipping." else echo " Installing agent-reach via pip ..." pip install agent-reach echo " Running agent-reach install ..." agent-reach install --env=auto fi ``` From `docs/install.md:12-17`: ```bash pip install agent-reach agent-reach install --env=auto ``` From `docs/install.md:30-34`: ```bash git clone [e-mail]:yy4fun/ai-news-skills.git cd ai-news-skills ./install.sh ``` ### Technical Analysis The installer retrieves `agent-reach` from the active Python package index without an exact version constraint or integrity hash. It then immediately invokes the downloaded package through: ```bash agent-reach install --env=auto ``` The repository does not contain the dependency's source code, so the behavior of this command cannot be established from the audited artifact. The effective installation payload may change after this Skill has been reviewed. The Git installation instructions also clone the repository's current default branch instead of a reviewed commit SHA or signed release. This permits the code executed by `./install.sh` to differ from the audited revision. This behavior is related to the declared web-reading functionality, but it is not least-risk installation practice. Installing and executing mutable third-party code grants the dependency the same operating-system privileges as the user running the installer. The pre-scan's separate allegation of a `curl | bash` chain was not confirmed. The repository's `curl` pipelines pass remote content to local data parsers ra ...[truncated 1618 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: skills/ai_news_reporter/SKILL.md:54

Finding

Group-Chat Feedback Can Persistently Rewrite Future Agent Analysis Rules

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (46)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 292)May include surrounding context.

md

| 飞书多维表格 | 存储原始新闻 & 日报输出 | ✅ |
| OpenClaw / Claude Code | 运行 skill、cron 调度 | ✅ |

> Agent Reach 底层使用 [jina reader](https://r.jina.ai) 将网页转为干净的 markdown（`curl r.jina.ai/URL`），这是 fetcher 采集管道的基础。Quick Start 中的安装命令会自动处理。

## 目录结构

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 292)May include surrounding context.

md

| 飞书多维表格 | 存储原始新闻 & 日报输出 | ✅ |
| OpenClaw / Claude Code | 运行 skill、cron 调度 | ✅ |

> Agent Reach 底层使用 [jina reader](https://r.jina.ai) 将网页转为干净的 markdown(`curl r.jina.ai/URL`),这是 fetcher 采集管道的基础。Quick Start 中的安装命令会自动处理。

## 目录结构

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior does not match the detected operational behavior: the skill claims a three-part automated news workflow, but the analysis indicates installation/setup actions, package installation, external command execution, workspace writes, and omission of one declared sub-skill. This mismatch is dangerous because users may approve the skill for benign content-processing purposes while it actually performs higher-risk system modifications and networked setup actions that were not transparently disclosed.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/install.md (reported line 56)May include surrounding context.

bash

cd ~/.openclaw/workspace/skills/ai_news_fetcher
curl -s "https://r.jina.ai/https://openai.com/zh-Hans-CN/news/" \
  | python3 normalize_agent_reach.py --source "OpenAI新闻"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install.sh (reported line 57)May include surrounding context.

sh

echo "1. Copy bitable_target.example.json to bitable_target.json for each skill"
echo "2. Fill in your own Feishu app/table configuration"
echo "3. Test the pipeline:"
echo "   curl -s 'https://r.jina.ai/https://openai.com/zh-Hans-CN/news/' \\"
echo "     | python3 ~/.openclaw/workspace/skills/ai_news_fetcher/normalize_agent_reach.py --source 'OpenAI新闻'"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

This duplicate finding points to the same risky behavior: remote content retrieval via curl to an external proxy endpoint inside an exec-oriented workflow. The surrounding context makes it more dangerous because the fetched output is immediately fed into local processing steps, so any trust mistake at the fetch boundary propagates through the rest of the pipeline.

Content

Scanner excerpt · skills/ai_news_fetcher/references/execution.md (reported line 30)May include surrounding context.

Step 1：抓取列表页

bash

curl -s "https://r.jina.ai/URL"

用 exec 运行，不要用 web_fetch 工具（两者结果不同）。

External Script Fetching

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

This duplicate finding points to the same risky behavior: remote content retrieval via curl to an external proxy endpoint inside an exec-oriented workflow. The surrounding context makes it more dangerous because the fetched output is immediately fed into local processing steps, so any trust mistake at the fetch boundary propagates through the rest of the pipeline.

Content

Scanner excerpt · skills/ai_news_fetcher/references/execution.md (reported line 30)May include surrounding context.

Step 1:抓取列表页

bash

curl -s "https://r.jina.ai/URL"

用 exec 运行,不要用 web_fetch 工具(两者结果不同)。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The changelog describes the skill behavior and features entirely in Chinese, including user-facing feature names and workflow descriptions, without indicating that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language locale policy concern because it implies a fixed language context without opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The changelog describes autonomous feedback logging, self-retrospective, and automatic watch-chain updates, which materially expand the skill from a bounded news workflow into a self-modifying or stateful behavior pattern not reflected in the stated metadata. Undocumented persistence and post-run behavior increase the risk of hidden data collection, unreviewed scope creep, and actions being taken without explicit user awareness or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The changelog reveals Feishu wiki publishing and wiki table-writing capabilities that are not disclosed in the high-level skill description. Undeclared outbound publishing/integration is dangerous because users may invoke a news analysis workflow without realizing it can write to external collaboration systems, potentially exposing generated content, internal summaries, or metadata to third-party destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README tells users to hand an installation URL to an AI agent and says the agent will automatically complete installation and configuration, including dependencies. That encourages delegated execution of remote installation steps without clearly warning that files may be written, dependencies installed, and workspace state changed, which is risky in an agentic environment where users may not inspect actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README provides prompts for creating cron jobs that perform recurring collection, report generation, local file writes, and external message delivery, but does not prominently warn about persistence and ongoing autonomous actions. In an agent setting, this can lead to durable behavior that continues after the initial request, potentially causing unwanted network access, data writes, or message sending.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The top-level skill manifest declares no explicit tool scope or permission boundaries even though the described workflow clearly depends on file access, network access, and likely shell/script execution. This is dangerous because it leaves the agent with ambiguous authority, increasing the chance of over-privileged execution, unsafe tool invocation, or user surprise about what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The install guide instructs users to execute ./install.sh directly from the cloned repository without any warning, inspection step, pinning, or integrity verification. Running repository shell scripts gives the skill author full code execution on the user's machine during installation, which is a real supply-chain risk even if the repository appears legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script unconditionally runs rm -rf on the destination skill directory before copying new content, which can destroy existing local files or user modifications without warning. In this skill context, the target is under a user workspace for agent skills, so accidental deletion can remove customized automation logic, local configs, or prior trusted versions and facilitate silent replacement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says this package contains three collaborating skills: ai_news_fetcher, ai_news_reporter, and ai_weekly_reporter. However, the installer only copies ai_news_fetcher and ai_news_reporter into the target skills directory, so the delivered behavior does not match the stated package contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written entirely in Chinese and specifies the skill purpose in that language without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation without any visible trigger constraints, while its default prompt authorizes collection of today's AI news and writing results into a Feishu raw-news table. That creates a real risk of the agent invoking this skill automatically in contexts the user did not explicitly intend, potentially causing unauthorized external writes, unwanted data collection, or action chaining.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI sets --field-language to zh by default and describes Chinese headers as the standard output format. This forces a specific language choice unless the user explicitly overrides it, which is a natural-language locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file specifies '推荐中文字段如下', establishing Chinese as the required or default locale for the skill's data model. Under the policy, forcing a specific language without user choice or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill defines a default output target that writes into a Feishu table and later instructs automatic record insertion, but it does not require an explicit confirmation or warning before modifying external data stores. In unattended or user-triggered runs, this can cause unintended data writes, corruption, or pollution of operational datasets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly instructs the agent to use shell execution for network retrieval instead of a safer purpose-built fetch tool. If the URL or source list is influenced by user input or configuration, this creates an unnecessary command-execution path that expands the attack surface and can enable command injection or unsafe fetch behavior in downstream implementations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow requires piping external content through local Python scripts via the shell, which couples untrusted network input to executable local tooling. Even if the scripts are intended for normalization, this pattern increases risk from unsafe argument handling, parser bugs, or later modifications that assume trusted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire guidance document is written only in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description states the skill generates reports in Chinese ("AI 日报、signal 和早报导读") without indicating that language selection is optional. This creates a natural-language locale policy concern because the skill appears to enforce a specific language by default with no user choice or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.