Security audit

RSS Feed Digest

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent RSS digest skill, with ordinary feed-fetching and optional file output, but users should treat feed URLs and generated content as untrusted.

Install and run this only with feed URLs you trust, especially on machines or agents that can reach private networks. Use --output with deliberate paths because it overwrites files, and treat generated Markdown as untrusted remote content before sending it to agents, newsletters, or renderers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rss_digest.py:28
Finding: Unrestricted Feed URLs Permit Server-Side Request Forgery and Local Resource Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rss_digest.py:72
Finding: Untrusted Feed Content Is Emitted as Unsanitized Markdown
Content: View full analysis
]+>", "", item["summary"])[:200] lines.append(f"> {clean}...\n") ``` ### Technical Analysis The feed title, entry title, entry link, and summary originate from remote feeds. These values are inserted into Markdown without escaping Markdown control characters or validating link schemes. The regular expression used on summaries only attempts to remove substrings resembling HTML tags. It is not a contextual Markdown sanitizer and does not prevent: - Injected headings, lists, links, or images - Newline-based escape from the intended blockquote - Malformed link syntax that changes document structure - Potentially unsafe or misleading URI schemes - Remote image references that can cause tracking requests in some renderers - Attacker-authored instructions presented as trusted digest content The output may subsequently be displayed by a Markdown renderer, included in a newsletter, or supplied to an AI agent. In agent workflows, malicious feed content may also act as indirect prompt injection, although this script itself does not execute instructions contained in the feed. ### Attack Path 1. An attacker controls a feed or can publish an entry to a monitored feed. 2. The attacker places crafted Markdown, line breaks, misleading links, or instruction-like text in the title, source name, summary, or link. 3. The Skill downloads and accepts the entry. 4. `format_markdown()` inserts the attacker-con ...[truncated 751 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:54
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation demonstrates file-writing capability via the --output option, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and review gap: consumers may invoke a skill that writes local files without explicit disclosure or restriction, increasing the risk of unintended file modification in automated environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The examples instruct users to write fetched and summarized content to local files, but provide no warning about overwriting existing files or storing potentially sensitive aggregated content on disk. While not inherently malicious, this can lead to accidental data loss or unintended local persistence, especially in automation contexts like cron jobs or shared environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.