Security audit

Info Magnet

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent information-monitoring helper, with expected local storage and network fetching, but users should be careful about sensitive topics and private URLs.

Install only if you are comfortable with the skill saving your monitored topics, feed URLs, page URLs, seen history, and digests locally under ~/.openclaw/memory. Use trusted public RSS feeds and pages; avoid localhost, private-network, cloud metadata, file-scheme, or sensitive internal URLs. Treat all retrieved feed/page text as untrusted content when summarizing it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/infomagnet.py:248
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Local Resource Access
Content: View full analysis
]+>", " ", content) text = re.sub(r"\s+", " ", text).strip()[:5000] h = hashlib.sha256(text.encode()).hexdigest()[:16] return {"url": url, "hash": h, "snippet": text[:300]} ``` ### Technical Analysis URLs supplied through the `--rss`, `--urls`, and `import-rss --url` arguments are stored and subsequently passed directly to `urllib.request.urlopen`. The implementation does not: - Restrict URLs to approved schemes such as HTTPS. - Reject local-resource schemes such as `file:`. - Block loopback, private, link-local, reserved, or multicast IP addresses. - Block common cloud metadata endpoints. - Resolve and validate hostnames before connecting. - Revalidate the destination after HTTP redirects. - Protect against DNS rebinding between validation and connection. Consequently, a user or attacker who can influence a magnet configuration can make the process issue requests to destinations that are not normally externally accessible. Because `urllib` supports more than ordinary HTTP URLs, loca ...[truncated 1764 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/infomagnet.py:251
Finding: Unbounded Network Response Reads Permit Memory-Exhaustion Denial of Service
Content: View full analysis
Remediation: View remediation
MAX_RESPONSE_BYTES: raise ValueError("Response exceeds the configured size limit") ``` 3. Reject responses whose declared `Content-Length` exceeds the limit, while still enforcing the streaming limit because the header may be missing or false. 4. Apply limits before decoding, XML parsing, regular-expression processing, or hashing. 5. Consider incremental XML parsing with limits on elements, nesting depth, text length, and item count. 6. Restrict accepted content types to expected feed or HTML formats. 7. Use process-level memory and execution limits for unattended scans. 8. Add tests using oversized fixed-length and chunked responses to verify that the scanner terminates safely. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: scripts/infomagnet.py:261
Finding: Untrusted Feed and Page Content Can Inject Instructions into the Agent Workflow
Content: View full analysis
]+>", " ", content) text = re.sub(r"\s+", " ", text).strip()[:5000] h = hashlib.sha256(text.encode()).hexdigest()[:16] return {"url": url, "hash": h, "snippet": text[:300]} ``` The documented workflow directs the Agent to process search and monitoring results, assess relevance, summarize findings, and forward the resulting digest. It does not establish a trust boundary that requires remote titles, descriptions, and page snippets to be treated exclusively as inert data. ### Technical Analysis RSS titles, RSS descriptions, and monitored-page text are controlled by remote publishers. The code stores those values in findings and digest files without identifying them as untrusted input or neutralizing instruction-like content. HTML tag removal is not a prompt-injection defense. An attacker can place plain-text directives in a feed description or page body, such as instructions to ignore prior constraints, invoke tools, disclose context, or alter the digest. When an Agent later consumes those fields for relevance filtering or summarization, it may interpret the embedded text as instructions rather than content. This is an indirect instruction-injection boundary: the remote publisher does not need direct access to the Agent session, because the monitoring workflow imports the publisher's text into that session. ### Attack Path 1. An attacker publishes an RSS item or monitored page containing instruction-like text in its title, description, summary, or body. 2. The victim configures the ...[truncated 1432 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents functionality that reads and writes local files under ~/.openclaw/memory and performs network access via RSS, URL monitoring, and agent-assisted web search, but it does not declare any explicit tool scope or permissions. This creates an authorization transparency gap: users and hosting systems cannot easily constrain or review the skill's actual capabilities, increasing the chance of overbroad file and network access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill stores monitored topics, feed URLs, monitored URLs, seen-link history, and generated digests locally, and the workflow explicitly contemplates forwarding summaries to the user through agent messaging. Without a prominent user warning, operators may unknowingly persist potentially sensitive interests or internal URLs and retransmit derived content, creating privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Most runtime status and result messages are emitted only in Chinese, despite the file presenting itself bilingually in the module header. This creates a language/locale constraint for users without any explicit language selection or opt-in mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The import-rss command immediately calls fetch_rss(args.url, limit=1), causing a network request to an arbitrary user-supplied URL before the user is clearly warned that external connections will occur. This can disclose IP address, user agent, and timing information to attacker-controlled endpoints, and in local/agent environments it also creates an SSRF-style primitive if internal URLs are supplied.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill title and primary instructional content begin in Chinese and much of the command guidance is written only in Chinese, which can impose a locale/language preference on users. There is no explicit statement that users may choose their preferred language or that the Chinese-first presentation is required for a region-specific purpose.
Content: No source excerpt is available for this finding.