ClawHub
Back to skill

Security audit

TingDong - 文章转AI播客

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sends article content and bearer-token-authenticated requests over plain HTTP and includes scraping-circumvention guidance, so it should be reviewed before installation.

Install only if you are comfortable sending article URLs or text, a user identifier, and an API token to the TingDong backend. Prefer a trusted HTTPS self-hosted backend, avoid private/internal links or sensitive text, and do not use the scraping guidance to bypass site access restrictions or terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tainted flow: 'url' from os.environ.get (line 18, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
headers = {}
    if API_TOKEN:
        headers["Authorization"] = f"Bearer {API_TOKEN}"
    return requests.get(url, headers=headers, timeout=timeout)


class Monitor:
Confidence
89% confidence
Finding
The request URL is built from an environment-controlled API base and then fetched directly, which creates an SSRF-style outbound request primitive if that environment variable is misconfigured or attacker-controlled. Because the same helper also attaches the bearer token, a hostile endpoint could receive authentication material or probe internal network locations through the monitor.

Tainted flow: 'FEISHU_WEBHOOK' from os.environ.get (line 12, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
# 如果有飞书webhook，发送消息
        if FEISHU_WEBHOOK:
            try:
                requests.post(FEISHU_WEBHOOK, json={
                    "msg_type": "text",
                    "content": {"text": message}
                }, timeout=10)
Confidence
85% confidence
Finding
Posting alerts to a webhook from configuration is expected for monitoring, but using an unvalidated environment-provided URL still permits data exfiltration to an attacker-chosen endpoint if the environment is compromised. The transmitted content is limited to alert text, so the impact is lower than credential-bearing API calls, but it still creates an external transmission channel.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation instructs use of environment variables for API tokens and performs outbound network access to a third-party backend, but there is no declared permissions model or explicit limitation around those capabilities. This is dangerous because it obscures the skill’s operational trust boundary: users may invoke a content-conversion skill without realizing it can access secrets from the environment and transmit user-provided content to an external service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly specifies plain HTTP for both the API base URL and audio delivery, which means submitted article URLs/text, user identifiers, task metadata, and returned audio links can be intercepted or modified by any network attacker on path. In the context of a skill that sends user-requested content to a remote service, failing to warn about unencrypted transport materially increases the risk of privacy loss and tampering.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The submission API accepts user-supplied content and a user_id but the documentation does not warn that this data is transmitted to and processed by an external remote service. In a skill that converts arbitrary web articles into podcasts, this omission can mislead integrators or end users about data handling, causing accidental disclosure of sensitive links, article text, or identifiers.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly recommends using Playwright to mimic a real browser and '绕过反爬' for WeChat content, which normalizes bypassing anti-scraping controls on third-party sites. In the context of a content-to-podcast tool that fetches arbitrary web pages, this can enable unauthorized access patterns, terms-of-service violations, and large-scale scraping of copyrighted content without sufficient compliance guardrails or user warnings.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script sends user-supplied article URLs or raw text to a remote backend service without any explicit notice, confirmation, or local-only alternative. In this skill's context, users may paste private article content, internal URLs, or sensitive text assuming the tool only reformats or synthesizes locally, creating a real privacy and data-handling risk.

Static analysis

No suspicious patterns detected.