read-news

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The codebase is primarily a benign news aggregator but includes high-risk dynamic code execution: it evaluates JavaScript extracted from remote HTML via new Function and documents an optional environment-configured shell command (CRYPTO_NEWS_EMBED_CMD) to run arbitrary external commands — both create potential remote-code-execution / exfiltration vectors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/feeds/googlenews.ts, runtime outsider-authored free text is ingested as the Google News RSS <title>/<description>/<link> content returned by fetchGoogleNews(query, ...), which is derived from user-provided --query/--asset (i.e., attacker-controlled search terms leading to attacker-influencable results) and then passed into the LLM via {records}.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches Google Finance pages at runtime (pageUrl = https://www.google.com/finance/quote/${encodeURIComponent(gfSymbol)}) and then uses parseAfCallback which evaluates an extracted AF_initDataCallback blob via new Function(...) — executing fetched page content as code at runtime, creating a high-risk execution vector.