T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_clawfeed.py:35- Finding
Remote Digest Content Can Overwrite Existing Notes
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawfeed Digest
Security checks for vulnerabilities and agentic risk
Overview
The skill’s core news-to-Obsidian function is coherent, but it also encourages recurring local writes and unverified third-party sync components with too little safety guidance.
Review before installing. Use a dedicated output folder, back up the Obsidian vault, avoid unattended cron until paths and overwrite behavior are understood, pin or verify dependencies, and do not install the optional BRAT/plugin/executable sync components unless you trust and verify those upstream projects.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_clawfeed.py:9- Finding
Missing Resource Limits Permit Network, Memory, and Disk Exhaustion
- Content
View full analysis
- Remediation
View remediation
= 0`. 3. Use streamed responses and enforce a maximum number of downloaded bytes. 4. Reject responses whose declared `Content-Length` exceeds the accepted ceiling. 5. Validate that the decoded JSON value is a list and that every entry contains a string `content` field. 6. Enforce maximum sizes for individual digest content and aggregate output. 7. Catch `requests.RequestException`, JSON-decoding errors, schema errors, and disk-write failures. 8. Prevent overlapping scheduled runs with an operating-system lock or application lock file. ]]>
T08 · Insecure Dependencies
Warning
- Location
README.md:24- Finding
Installation Guidance Uses Unpinned and Unverified Third-Party Components
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 3. Maintain a lockfile generated from reviewed dependency versions, including transitive dependencies. 4. Reference exact, immutable third-party releases instead of mutable release pages or branches. 5. Publish expected SHA-256 checksums and require users to verify downloaded archives and executables before execution. 6. Prefer cryptographically signed releases and document signature verification. 7. Avoid recommending that users disable plugin safety controls unless the security implications and necessity are clearly explained. 8. Run synchronization software with a dedicated least-privilege account and restrict its filesystem access to only the required directories. 9. Separate optional synchronization-service guidance from the core digest fetcher so users do not infer that unrelated third-party software is required. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly states it will automatically write fetched content into a specified Obsidian directory, but the documentation does not clearly warn users that local files will be created or modified. In an agent or automation context, this can lead to unintended persistent changes to a user's knowledge base, especially if the output path is misconfigured or run unattended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The scheduled task example encourages recurring execution of a script that performs file writes, but it does not warn that this will repeatedly modify the local Obsidian vault. In unattended environments, this increases the risk of silent accumulation of files, overwrites, or unwanted persistence of external content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file is written entirely in Chinese and later specifies a scheduled runtime in Beijing time, but it does not indicate that the skill is region-specific or provide any language/locale option. This matches the policy category for language or locale constraints imposed without user opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document instructs users to disable Obsidian's security mode and install a third-party plugin via BRAT, but it does not warn that this bypasses the application's normal trust controls and increases exposure to malicious or compromised plugin code. In this context, the skill is directly guiding users to reduce a security safeguard and execute unreviewed extensions, which materially increases supply-chain and local code-execution risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly advertises move/rename and delete capabilities for user notes without any caution about destructive effects, recovery limits, or the possibility of accidental data loss. In a skill that operates directly on an Obsidian vault, normal use or prompt-driven misuse could lead to unintended modification or deletion of personal knowledge-base content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The delete command is shown as a simple one-line example with no warning that it removes user data from the vault, which lowers user caution around an irreversible or hard-to-recover action. Because this skill is meant for direct operational use, omission of deletion risk messaging increases the chance of accidental data loss through copy-paste or agent-driven execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The argument parser description and help strings are presented only in Chinese, which imposes a specific language on all users. The policy allows locale constraints only when users are offered a language choice or the restriction is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs local file writes using content retrieved from a remote API, but the only user-facing notice appears after the write completes. There is no confirmation prompt or pre-action disclosure explaining that files will be created or overwritten in the target directory.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The README content and user-facing descriptions are written in Chinese, which can amount to a language policy constraint when no user opt-in or alternative language option is provided. The policy allows locale constraints when they are explicitly justified or optional, but neither is indicated here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file states that the skill will automatically write fetched digests into a specified Obsidian directory, but it does not include any caution about local file modification, overwrite risk, or the need to verify the target path. For markdown files, user-facing descriptions should warn about behaviors that can affect user data or system integrity.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language content and usage guidance are presented in Chinese, which can impose a language constraint on users without any opt-in or alternative. The policy allows locale constraints when documented and justified, but this file does not explain that limitation or offer another language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document title and description are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented regional reason. Under the policy criteria, this can be treated as a locale/language constraint presented without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill documentation appears to require Chinese for all user-facing instructions without offering an alternative language or noting that the locale is intentionally limited. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file documents a scheduled task that will '抓取 ClawFeed AI 日报并写入 Obsidian', which is a user-data-affecting write operation. The surrounding description explains timing but does not warn that the automation modifies local note content or clarify overwrite/append behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Natural-language policy violations include forcing a specific language or locale without user opt-in. This file presents all substantive guidance in Chinese and does not offer an alternative language or explain that the skill is intentionally region- or language-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The script contacts an external API to retrieve digest content, but there is no visible warning or description to the user that it will send a request to a third-party endpoint. For safety transparency, network access should be disclosed before or during execution.
- Content
Static analysis
No suspicious patterns detected.