T01 · Skill Instruction Hijacking
Error
- Location
scripts/fetch_news.py:24- Finding
Indirect Prompt Injection Through Untrusted Article Content
- Content
View full analysis
- Remediation
View remediation
Security audit
News Aggregator Skill 0.1.0
Security checks for vulnerabilities and agentic risk
Overview
This is a real news-aggregation skill, but its deep-fetch mode retrieves untrusted article URLs and content without enough boundaries, which merits Review before installation.
Install only if you are comfortable with a news skill making outbound web requests and saving local report files. Avoid or sandbox --deep mode on networks with private services or cloud metadata access, and consider pinning dependencies and the install source before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_news.py:24- Finding
Server-Side Request Forgery Through Feed-Controlled Article URLs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Dependencies and Mutable Remote Installation Sources
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states the skill generates a Chinese daily/weekly report, which imposes a specific language on users. There is no nearby indication that users can choose another language or opt into Chinese output, so this conflicts with the language/locale policy criteria.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The README instructs users to install the skill via
npx skills add https://github.com/cclank/news-aggregator-skillwithout pinning a specific version, commit, or release. That makes installation depend on mutable upstream content and the currentskillspackage resolution, creating a supply-chain risk if the package or repository is compromised or updated unexpectedly.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone git@github.com:cclank/news-aggregator-skill.git # 2. 定位或创建项目的 skills 目录 mkdir -p YourProject/.claude/skills # 3. 将整个文件夹复制过去 cp -r news-aggregator-skill YourProject/.claude/skills/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp -r news-aggregator-skill YourProject/.claude/skills/
4. 验证：确保 SKILL.md 存在于目标目录
ls YourProject/.claude/skills/news-aggregator-skill/SKILL.md
text ### 第二步：安装 Python 依赖（如果你的agent足够聪明，可以跳过）
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill invokes a network-capable script (
fetch_news.py) but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what the skill is permitted to access over the network.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase includes vague language like 'or similar menu/help triggers', which invites overly broad matching and accidental activation. In an agent setting, ambiguous triggers can cause the skill to run in contexts the user did not clearly intend, increasing the chance of unnecessary network access or file reads.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The instruction 'Language: Simplified Chinese' imposes a specific language requirement with no opt-in, alternative, or documented region-specific justification, which can conflict with organizational language-choice policies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requires saving reports to the local
reports/directory every time, but it does not warn the user or ask for consent before creating files. Mandatory disk writes can leak sensitive query topics, create unintended local artifacts, and violate expectations in environments where persistence should be explicit.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The default source map prominently includes Chinese platforms such as Weibo, 36Kr, Tencent News, and Wall Street CN, and the script can fetch all of them when the user does not specify a source. This imposes a locale/language choice in the skill behavior without offering the user an explicit language or region preference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The menu and instruction text require interaction in Chinese ('请回复序号...') and all provided prompts are Chinese-only, without offering a language choice. This can violate language/locale policy when the skill does not explicitly let the user opt into Chinese or choose another language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The '全网扫描（所有源）热点新闻' template encourages an unbounded, multi-source scan without user-specified limits such as topic, timeframe, result count, or cost controls. In an agent setting this can lead to excessive tool use, unnecessary data collection, long-running tasks, and increased spend or rate-limit exhaustion, especially because this skill aggregates eight external sources.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency
requestsis unpinned, so installs may resolve to different versions over time, harming reproducibility and potentially pulling in a newly vulnerable or incompatible release. In a news aggregation skill that fetches remote content from many external sources, network-facing libraries are part of the attack surface, so lack of version control modestly increases supply-chain and reliability risk.- Content
text requests beautifulsoup4
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
requestshas multiple known advisories, and because no version is pinned, it is impossible to verify whether the deployed environment is using a fixed or vulnerable release. This is more concerning in a skill that performs outbound requests to many external sources, since issues in HTTP handling, redirect processing, or credential handling could be exposed through attacker-controlled URLs or responses.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency
beautifulsoup4is also unpinned, which means future installs are non-deterministic and may unexpectedly introduce vulnerable or breaking releases. Because this skill parses content from multiple third-party news sources, parser behavior changes or vulnerable releases could affect security and stability when handling untrusted HTML.- Content
text requests beautifulsoup4
Static analysis
No suspicious patterns detected.