ClawHub
Back to skill

Security audit

Clawfeed

Security checks for vulnerabilities and agentic risk

Overview

The skill is a news digest server, but its documentation contradicts itself about whether state-changing API endpoints require authentication.

Review this skill carefully before installing or exposing it. If used, keep the API bound to localhost or behind trusted access control, and require authentication or an API key for all POST, PUT, DELETE, and configuration endpoints before deploying it beyond a private environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The documentation states the tool runs in read-only mode and that write features require credentials, but it also documents unauthenticated POST /api/digests and PUT /api/config endpoints. This mismatch can mislead operators into deploying the service with unsafe assumptions, leaving system-changing functionality exposed without access control.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The auth/credentials section says digest creation requires an API key and auth features require credentials, but the endpoint table marks mutating endpoints as unauthenticated. That contradiction increases the likelihood of accidental exposure of privileged functionality and suggests broken or undocumented access-control expectations.

Credential Access

High
Category
Privilege Escalation
Content
npm install

# Copy environment config
cp .env.example .env
# Edit .env with your settings

# Start API server
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
npm install

# Copy environment config
cp .env.example .env
# Edit .env with your settings

# Start API server
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented API exposes state-changing endpoints, including digest creation and configuration updates, without indicating authentication or warning users that they modify server state. In skill context, this is dangerous because users may invoke those endpoints assuming they are safe read operations, enabling unauthorized changes or abuse of backend resources.

Static analysis

No suspicious patterns detected.