ClawHub
Back to skill

Security audit

Podcast Workflow

Security checks for vulnerabilities and agentic risk

Overview

This podcast helper is mostly coherent, but it tells agents to fetch arbitrary user-provided URLs with curl without clear safety limits.

Review before installing. Use it only with public podcast, video, RSS, or transcript URLs you intend the agent to fetch, and avoid private links, internal services, authenticated pages, local file URLs, or confidential transcripts unless your OpenClaw runtime has separate URL-fetching protections.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:35
Finding

Unrestricted User-Controlled URL Fetching Enables SSRF

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–37
Vulnerability Type: Server-Side Request Forgery through unrestricted curl usage
Risk Level: Medium

Vulnerable Code:

markdown
**If the user provides a URL (YouTube, Spotify, RSS, etc.):**
- Use `curl` to fetch the page and extract any available transcript or description.
- If no transcript is available, tell the user: "No transcript found at this URL. Please paste the transcript text directly."

Technical Analysis

The skill instructs the agent to fetch a user-supplied URL with curl without defining security controls for URL schemes, destination hosts, DNS resolution, redirects, or response size. Consequently, an attacker may provide URLs that target loopback, private, link-local, or otherwise restricted resources reachable from the agent's runtime.

Depending on the runtime's curl configuration, non-HTTP schemes such as file:// may also permit access to local files. Redirects and DNS rebinding could bypass superficial hostname checks unless destinations are validated after DNS resolution and on every redirect.

Although this instruction retrieves content rather than executable code, the fetched material enters the agent's processing context and may be disclosed through generated podcast assets.

Attack Path

  1. An attacker invokes the skill with a crafted episode URL instead of a transcript.
  2. The URL targets a sensitive resource, such as a loopback service, private-network endpoint, cloud metadata service, or local file supported by curl.
  3. Following SKILL.md, the agent executes curl against the attacker-controlled destination.
  4. The runtime retrieves content using its own network access and privileges.
  5. The agent processes the response as a transcript or episode description.
  6. Sensitive response data may be reproduced in show notes, social posts, metadata, or other generated output and returned to the attacker.

Redirect chains or DNS rebindi ...[truncated 715 chars]

Remediation
View remediation

Remediation Suggestions

  • Permit only https:// URLs and explicitly reject all other schemes, including file, ftp, gopher, and data.
  • Use an allowlist of expected public podcast, RSS, and video hosts where practical.
  • Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
  • Repeat destination validation after every DNS resolution and redirect; do not rely solely on the original hostname.
  • Disable redirects unless required. If enabled, set a small redirect limit and validate each destination.
  • Apply strict connection, transfer, and total timeouts.
  • Limit response size and reject unsupported content types.
  • Run retrieval through an isolated outbound proxy with network-level controls that cannot access internal services or cloud metadata endpoints.
  • Treat fetched pages as untrusted data and ensure their contents cannot introduce new agent instructions.
  • Prefer a dedicated transcript-fetching component with a constrained API instead of issuing unrestricted curl requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation advertises support for YouTube, RSS feeds, and plain URLs but provides no warning that the skill may fetch remote content and process potentially sensitive transcript data. Without user-facing warnings, users may unknowingly expose private URLs, internal endpoints, copyrighted material, or confidential transcript content to downstream processing, making the skill materially riskier in real deployments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README instructs users to invoke the skill with a very broad trigger and to provide either arbitrary transcript text or arbitrary URLs, while claiming the skill 'handles the rest' with no options required. This increases the chance of unintended activation and processing of attacker-controlled external content, which can lead to unsafe fetch behavior, privacy issues, or misuse in contexts the user did not fully intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description includes broad trigger terms such as podcast, episode, transcript, show notes, chapters, and timestamps that can match routine user requests without a clear intent to invoke a full post-production workflow. This can cause overbroad auto-activation, pulling the agent into fetching URLs or generating large structured outputs in contexts where the user only wanted a narrow answer, increasing the chance of unintended tool use or confusing behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example trigger phrase 'clip this' is highly ambiguous and commonly used in ordinary conversation, not just podcast editing contexts. In an auto-selection system, this can spuriously activate the skill for unrelated requests, leading to inappropriate workflow execution and possible external URL fetching or oversized content generation without clear user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.