ClawHub
Back to skill

Security audit

AI News Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI news digest, but it automatically sends to Feishu using a recipient read from broad workspace memory and deletes its draft after sending.

Review before installing if your workspace MEMORY.md may contain private notes, identifiers, tokens, or other unrelated data. Prefer configuring the Feishu recipient in a dedicated setting and decide whether automatic draft deletion is acceptable for your audit needs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:191
Finding

Overbroad Access to Persistent Agent Memory for Feishu Target Resolution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:191-194 and repeated at SKILL.md:216-220
Vulnerability Type: Least-privilege violation through access to general-purpose persistent memory
Risk Level: Low

Relevant excerpt translated into English:

text
### Stage Four: Read the draft and send it

1. Read [WORKSPACE]/memory/ai-news-draft.md
2. Invoke the message tool to send to Feishu:
   target="Dynamically read the Feishu user ID from [WORKSPACE]/MEMORY.md"
3. Delete [WORKSPACE]/memory/ai-news-draft.md after sending

Feishu target format:
"Dynamically read the Feishu user ID from [WORKSPACE]/MEMORY.md"

message(
    action=send,
    channel=feishu,
    target="Dynamically read the Feishu user ID from [WORKSPACE]/MEMORY.md",
    message="content"
)

Technical Analysis

The Skill instructs the Agent to access the general-purpose persistent file [WORKSPACE]/MEMORY.md to retrieve a Feishu user ID. A persistent Agent memory file can contain information unrelated to news delivery, including conversation context, identifiers, preferences, or operational state.

Reading this broad memory store violates least privilege because the sending workflow only requires one destination identifier. The Skill does not define a constrained parser, dedicated configuration field, access-control boundary, or validation procedure that limits retrieval to the intended identifier.

This finding does not establish that the complete memory file is transmitted externally. The documented outbound message contains the generated news digest, while the memory-derived value is used as the Feishu destination. The confirmed issue is unnecessary access to a broader persistent data store than the task requires.

Attack Path

  1. A cron invocation places the Skill in sending mode.
  2. The Agent reads [WORKSPACE]/memory/ai-news-draft.md.
  3. To determine the Feishu destination, the Skill directs the Agent to open t ...[truncated 989 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the Feishu recipient ID in a dedicated configuration field, such as [WORKSPACE]/config/ai-news-tracker.json, containing only the required target.
  2. Prefer a platform-managed secret or environment variable, such as FEISHU_NEWS_TARGET, with access restricted to this Skill.
  3. Prohibit the workflow from reading general-purpose Agent memory for transport configuration.
  4. Validate the target against the expected Feishu identifier format before invoking the messaging tool.
  5. Apply an allowlist so the Skill can send only to explicitly configured recipients.
  6. Ensure logs do not record recipient identifiers or unrelated memory content.
  7. If migration from MEMORY.md is necessary, perform a one-time extraction under explicit user approval and then remove the memory-reading instruction.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill can be triggered when the user says "帮我查一下今天 AI 有什么新闻" or similar expressions. The "或类似表达" wording makes the trigger boundary unclear and broadens activation to unspecified everyday requests about news, which can cause unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill deletes [WORKSPACE]/memory/ai-news-draft.md after sending but does not clearly warn users that a generated local artifact will be removed automatically. Automatic deletion can interfere with user expectations, auditability, incident review, or retention requirements, especially in an automated cron workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill transmits generated content to Feishu and pulls a user identifier from workspace memory without a clear privacy notice or consent boundary. In an automated scheduled context, this increases the risk of sending content or identifiers to an unintended recipient and of processing personal data without sufficient transparency.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to read [WORKSPACE]/MEMORY.md to obtain a Feishu recipient ID, which expands access beyond the stated news-tracking function into workspace data retrieval. Even if the intended field is only a user ID, this creates an unnecessary cross-file data dependency that could expose unrelated sensitive data if the memory file contains additional notes, tokens, contacts, or personal information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The realtime tracking rules state a strict 12-hour event window, but the execution flow later instructs the agent to compute T-2 and use after:YYYY-MM-DD in all searches, and then says to discard events older than 48 hours. That is an active contradiction in the documented intent, making the implemented/search-guided behavior diverge from the stated realtime policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The note states that summaries should be primarily in Chinese, with English terms optionally retained. This imposes a language preference without offering the user a choice or documenting an opt-in, which conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.