ClawHub
Back to skill

Security audit

Smart Journal Monitor(RSS+AI)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple local article-scoring helper with some imprecise documentation, but I found no hidden network use, persistence, credential access, or destructive behavior.

Install only if you want a local, simple JSON-based article scoring helper rather than a real RSS or AI journal monitor. Provide only intended article JSON files, since the script does not enforce path restrictions or validate input schema.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose emphasizes bounded, structured evidence workflows, but the detected behavior includes undeclared article scoring, CLI file ingestion, and a demo trigger not reflected in the description. This mismatch is dangerous because reviewers and users may trust the safer declared behavior while the implementation performs additional actions or accepts inputs that expand attack surface, including prompt/input abuse and unexpected file handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises executable Python behavior and file access but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and can cause the skill to run with broader-than-expected file access in agent environments, increasing the chance of unintended local file reads.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation guidance is broad enough to match many generic evidence or research tasks without narrow trigger conditions. Over-broad routing can cause the skill to be selected in contexts it was not designed for, increasing the chance of misuse, unsafe assumptions, or execution of code against inappropriate inputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The risk table claims no external API calls even though the skill is presented as an RSS-based journal monitor, which strongly implies outbound network access to fetch feeds. Misstating network behavior undermines operator trust and may lead to deployment in environments where data egress, tracking, or unreviewed remote content ingestion should have been restricted.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Items like 'Staying current with field developments' and 'Competitive intelligence' are high-level and nonspecific, with no limiting context or exclusions. In a markdown skill description, such broad use cases can act as ambiguous activation cues and increase unintended invocation risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.