cctv-news-fetcher
Fail
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The script at
scripts/news_crawler.jsincludes a hardcodedcnatracking cookie header. Hardcoding session or tracking tokens in source code is a poor security practice that can lead to credential exposure or unauthorized user tracking. - [COMMAND_EXECUTION]: The instructions in
SKILL.mddirect the agent to execute the shell commandbun {baseDir}/scripts/news_crawler.js <YYYYMMDD>, where the<YYYYMMDD>parameter is directly controlled by user input. This pattern presents a high risk of command injection if the agent does not strictly validate the input, allowing an attacker to execute arbitrary system commands by appending shell metacharacters to the date string. - [EXTERNAL_DOWNLOADS]: The skill fetches data from official CCTV domains (
cctv.cntv.cnandtv.cctv.com). This is a legitimate part of the skill's news-fetching functionality and targets well-known official sources.
Recommendations
- AI detected serious security threats
Audit Metadata