ClawHub
Back to skill

Security audit

mp2rss

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core mp2rss behavior is coherent, but its install and update guidance grants high-impact local execution and skill-sync authority from mutable remote sources.

Review the install and update paths before installing. Prefer pinned package or release-based installation with checksums, avoid running curl | sh from a mutable branch, and be aware that mp2rss auth stores a Feed Key locally and that skill sync/update commands can change installed agent skills across sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The pipe to sh forms an unsafe command chain that turns a network fetch into immediate shell execution with no review step. In a skill README, this materially increases danger because users are being instructed to perform the chain as part of setup, making exploitation straightforward if the remote content changes or is intercepted.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

pnpm add -g @mp2rss/cli

方式 B：macOS / Linux 一键脚本

curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh

text

也可在 [Releases](https://github.com/areyoubugcoder/mp2rss-cli/releases/latest) 下载对应平台二进制。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 111)May include surrounding context.

方式 B：手动

mkdir -p ~/.openclaw/workspace/skills/mp2rss cd ~/.openclaw/workspace/skills/mp2rss curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/SKILL.md -o SKILL.md curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/package.json -o package.json

视需要再拉 references/ 子文档

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping the result of curl directly into sh is a classic command-chaining anti-pattern that immediately turns any compromise of the fetched content into local code execution. In an installation guide for a CLI, this is especially dangerous because users are likely to run it verbatim, often with elevated trust and sometimes elevated privileges.

Content

Scanner excerpt · references/install.md (reported line 27)May include surrounding context.

B. 一键脚本（macOS / Linux）

bash
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh

自动选 macOS / Linux 对应平台二进制，安装到 /usr/local/bin 或 ~/.local/bin。

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README instructs users to pipe a remote script directly into sh, which executes unreviewed code fetched at runtime from a mutable remote source. This creates a significant supply-chain and remote code execution risk if the upstream repository, network path, or referenced branch is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

md
openclaw skills install mp2rss

# 方式 B：手动
mkdir -p ~/.openclaw/workspace/skills/mp2rss
cd ~/.openclaw/workspace/skills/mp2rss
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/SKILL.md -o SKILL.md
curl -sL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/openclaw/mp2rss/package.json -o package.json

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase “状态” is so generic that it can accidentally match many unrelated user requests, causing the agent to invoke this skill outside its intended scope. In a skill that can inspect login state and drive authenticated CLI flows, over-broad routing increases the chance of unintended command execution, context confusion, and disclosure of account-related metadata such as whether the user is logged in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This manifest description enumerates many generic actions such as subscription management, searching, querying history, and content pulling, but does not define when the skill should activate or what specific invocations are in scope. In a manifest file, the absence of explicit trigger constraints or negative examples can lead to unintended invocation overlap with common content-management requests.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The documentation instructs use of npx -y skills add areyoubugcoder/mp2rss-cli -y without pinning an exact package version or integrity hash. That allows whatever package/version is current at execution time to be fetched and executed, creating a supply-chain risk if the package is compromised, updated maliciously, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/install.md (reported line 67)May include surrounding context.

CLI 自更新只替换二进制，本地已安装的 Agent Skills 不会自动跟着升级。CLI ≥ 1.2.0 内置同步命令（旧版本无此命令，继续用 npx -y skills add areyoubugcoder/mp2rss-cli -y）：

bash
mp2rss skills sync              # 同步到当前项目 ./.agents/skills
mp2rss skills sync --global     # 同步到全局 ~/.claude/skills
mp2rss skills status [-o json]  # 本地 skills 版本 vs CLI 版本，是否漂移
mp2rss skills list [-o json]    # 列出仓库提供的 skills

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This line again references npx -y skills add areyoubugcoder/mp2rss-cli -y as the underlying sync mechanism without version pinning. Unpinned remote package execution is risky because users may execute changed or compromised code from the registry/GitHub ecosystem with no reproducibility guarantees.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill description and all example invocations are presented as Chinese user phrases, which implies the skill expects or is optimized for a specific language. There is no explicit statement that other languages are supported, nor any user opt-in or justification that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

Fetching and executing an external script from raw.githubusercontent.com/.../main/... relies on mutable remote content and grants that content shell execution on the user’s machine. In the context of a CLI/agent skill, this is especially dangerous because users may follow installation instructions with elevated trust and limited review.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

pnpm add -g @mp2rss/cli

方式 B：macOS / Linux 一键脚本

curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh

text

也可在 [Releases](https://github.com/areyoubugcoder/mp2rss-cli/releases/latest) 下载对应平台二进制。

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states that the message field is human-readable and specifically in Chinese, and says it can be forwarded directly to the user. This imposes a specific language/locale in the skill behavior without indicating user opt-in or alternative language handling.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The install instructions tell users to fetch a shell script over the network and execute it directly via curl ... | sh. This pattern removes opportunities for inspection and makes users trust both the transport and the remote repository state at execution time, so a repository compromise, MITM in a weakened environment, or malicious script update can lead to arbitrary code execution.

Content

Scanner excerpt · references/install.md (reported line 27)May include surrounding context.

B. 一键脚本（macOS / Linux）

bash
curl -fsSL https://raw.githubusercontent.com/areyoubugcoder/mp2rss-cli/main/scripts/install.sh | sh

自动选 macOS / Linux 对应平台二进制，安装到 /usr/local/bin 或 ~/.local/bin。