ClawHub
Back to skill

Security audit

ntfy-notify

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims by sending ntfy.sh notifications, but its documented shared default topic can expose messages to anyone who knows or guesses it.

Review this before installing if you may send private information. Use an explicit private, high-entropy ntfy topic for every send, avoid secrets or personal data in message bodies and headers, and treat the documented default topic as public and untrusted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_ntfy.sh:4
Finding

Predictable Shared Default Topic May Expose Notifications

Content
View full analysis

Vulnerability Details

File Location: scripts/send_ntfy.sh:4, 61-63
Vulnerability Type: Predictable public notification topic
Risk Level: Medium

Vulnerable Code

bash
TOPIC="CaptainDragonflyBot-TopicTest001"
bash
CMD+=("https://ntfy.sh/$TOPIC")

"${CMD[@]}"
echo

The same default topic is disclosed in SKILL.md:17-20:

markdown
## Default topic

- `CaptainDragonflyBot-TopicTest001`

Technical Analysis

The script sends notification bodies and metadata to the public ntfy.sh service. If the caller does not supply --topic, it uses a fixed, predictable topic whose value is published in the project documentation.

A topic name may function as the practical access boundary for an unauthenticated ntfy channel. Because this default is neither secret nor high entropy, unauthorized parties can discover it and attempt to subscribe or publish to the same channel. The script does not require authentication, require an explicit topic, or warn callers that notification data is transmitted to a third-party service.

This is not shell command injection: the script constructs curl arguments with a Bash array and does not evaluate user input as shell code.

Attack Path

  1. An attacker obtains the default topic from SKILL.md, the script source, or another public copy of the package.
  2. The attacker subscribes to CaptainDragonflyBot-TopicTest001 through the public ntfy service.
  3. A user invokes send_ntfy.sh without specifying --topic.
  4. The script sends the notification to the documented default topic.
  5. If the public service permits unauthenticated access to that topic, the attacker receives the notification and its associated metadata.
  6. The attacker may also attempt to publish deceptive notifications to the same topic, potentially misleading legitimate subscribers.

Impact Assessment

Exploitation does not grant local code execution, operating-syst ...[truncated 673 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the built-in public topic and require callers to provide --topic explicitly.
  2. Validate that the topic is nonempty and reject execution when it is omitted.
  3. Recommend a cryptographically random, high-entropy topic rather than a human-readable shared identifier.
  4. Prefer an authenticated private ntfy deployment or authenticated access controls for sensitive notifications.
  5. Clearly document that message bodies and metadata are transmitted to an external service.
  6. Warn users not to send credentials, access tokens, personal data, or other secrets through public topics.
  7. Consider allowing the server URL and authentication credentials to be supplied securely through protected configuration, while ensuring credentials are not exposed in logs or command output.
  8. Rotate and discontinue the documented default topic because its value should be considered publicly known.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes a shell script but does not declare any tool scope such as permissions or allowed-tools. That means an agent may execute shell-capable behavior without an explicit policy boundary, increasing the chance of unintended command execution, outbound network use, or misuse of user-supplied parameters.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This script performs an outbound network request to https://ntfy.sh using curl and includes arbitrary message text plus optional headers such as click links, actions, attachments, and filenames. In a skill environment, external transmission is security-relevant because it can exfiltrate sensitive data or trigger unreviewed data sharing to a public notification topic.

Content

Scanner excerpt · scripts/send_ntfy.sh (reported line 52)May include surrounding context.

sh
MESSAGE="这是一条默认消息，现在是${NOW_UTC}，来自沉舟老爷的小跟班"
fi

CMD=(curl -fsS -d "$MESSAGE")

[[ -n "$TITLE" ]] && CMD+=(-H "Title: $TITLE")
[[ -n "$PRIORITY" ]] && CMD+=(-H "Priority: $PRIORITY")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script transmits user-supplied message content and metadata to the public ntfy.sh service via curl, but provides no consent prompt, visibility control, or warning that data is leaving the local environment. In an agent/skill context, this can cause unintended disclosure of sensitive prompts, links, filenames, or operational metadata to an external third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The hardcoded default message is written in Chinese, which imposes a specific language choice on output when the user does not provide a message. There is no option, prompt, or documentation offering a language preference or explaining a justified region-specific constraint.

Content

No source excerpt is available for this finding.