ClawHub
Back to skill

Security audit

News Collect

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its real news-fetching and dependency installation rely on repo-local files that were not included in the reviewed artifact.

Before installing, review the repo's requirements files and the full news-aggregator-skill implementation, then run it in an isolated environment with only the workspace access it needs. Expect it to contact configured news sources and write raw JSON plus markdown reports under content-production/inbox.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Unverifiable Dependency Installation from Manifests Outside the Audited Artifact

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 18–24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
.venv/bin/pip install -r requirements.txt
bash
.venv/bin/pip install -r skills/news-aggregator-skill/requirements.txt

Technical Analysis

The documented installation procedure instructs users to install Python packages from two requirement manifests that were not included in the audited artifact. Consequently, the audit could not verify package names, version constraints, hashes, transitive dependencies, package indexes, or installation-time behavior.

The second command additionally trusts the dependencies of the external news-aggregator-skill, whose implementation and requirements were also absent. Python packages can execute code during installation or when imported. If either manifest or a referenced package is compromised, substituted, typo-squatted, dependency-confused, or insufficiently pinned, attacker-controlled code could run under the account performing the installation.

This finding does not establish that any referenced dependency is currently malicious. It identifies an unverifiable supply-chain trust boundary in the documented installation process.

Attack Path

  1. An attacker compromises or modifies one of the external requirement manifests, publishes a malicious package matching an unpinned or ambiguously resolved dependency, or exploits dependency confusion through an unintended package index.
  2. A user follows the installation instructions in README.md.
  3. pip resolves and downloads the attacker-controlled package or malicious transitive dependency.
  4. Malicious code executes through installation hooks, build-system behavior, or a later package import.
  5. The code runs with the privileges of the user executing pip or invoking the Skill.

Impact Assessment

A successfully compromised dependency could obtain the same privileges available t ...[truncated 517 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include every dependency manifest needed to install and run the Skill in the reviewed package.
  2. Pin direct and transitive dependencies to exact, reviewed versions.
  3. Record cryptographic hashes and install with pip install --require-hashes.
  4. Restrict installation to explicitly approved HTTPS package indexes and disable unintended fallback indexes.
  5. Generate and retain a lock file or software bill of materials for reproducible review.
  6. Audit or vendor news-aggregator-skill and its dependencies before execution.
  7. Run installation and the Skill in an isolated environment with minimal filesystem, credential, and network access.
  8. Document the vendor component’s permitted network destinations and data handling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose says the skill normalizes news scan output, but the workflow also injects editorial scoring and writing-direction generation that is not clearly disclosed in the top-level description. Description-behavior mismatches are risky because operators may authorize a seemingly narrow data-processing skill that actually performs additional content transformation and decision support beyond expected scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises shell, file-read, and file-write behavior but declares no explicit tool scope or permissions boundary. In an agent environment, that omission weakens least-privilege controls and makes it easier for the skill to read or modify unintended workspace content or invoke shell commands without clear user-visible constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill description embeds Chinese-language requirements such as 轻量级写作决策字段, suggesting a specific language/locale expectation. Because the document does not provide user opt-in or explain that the skill is intentionally region- or language-specific, this may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

These lines require output for 人工选题与后续深研 and 写作价值判断、推荐切口、推荐框架与标题方向, which imposes a Chinese-language content policy on generated results. The skill does not indicate that this is an optional locale mode or a clearly justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default title string is in Chinese (资讯扫描), and the skill consistently generates Chinese report labels and guidance throughout the file. Because this is natural-language behavior in a code file and there is no opt-in or documented region-specific justification, it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · runtime.py (reported line 381)May include surrounding context.

python
request = resolve_request(input_path)
    command = build_command(workspace_root=workspace_root, vendor_root=vendor_root, request=request)

    completed = subprocess.run(
        command,
        cwd=vendor_root,
        capture_output=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file explains that the skill invokes an embedded news-aggregator-skill to perform data fetching, which implies network access to external or internal news sources. There is no accompanying warning that the skill makes network requests or may transmit query/input data to external services, which is a markdown-scope missing-warning issue under SQP-2.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file states that the skill outputs a report file and saves raw JSON into specific repository paths, which means it affects local user data by creating or overwriting files. The description does not include any warning or disclosure about these filesystem side effects, even though SQP-2 requires warnings in markdown when behavior could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file instructs the skill to save raw JSON and markdown outputs into specific local paths, which affects user data in the workspace. The description explains where files are written, but it does not explicitly warn the user that running the skill will create or overwrite files in those locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest explicitly states that the skill will write a standardized report and raw JSON into local repository paths, but it does not warn the user that running the skill modifies the filesystem. This is a real transparency and safety issue because users may invoke a 'collect' skill expecting read-only scanning behavior, while the skill persists artifacts locally and could overwrite or create files unexpectedly.

Content

No source excerpt is available for this finding.