Steps to reproduce: 1. Extract the PoC files from the tarball somewhere; 2. Run "python3 -m http.server 9001" (or similar); 3. Try to subscribe to http://localhost:9001/ in Liferea; 4. Liferea will show a parsing error (expected), but feed auto-discovery already created and ran a command feed source that created file /tmp/bad-feed-discovery.txt