ClawHub
Back to skill

Security audit

WeChat RSS

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it processes untrusted article HTML directly in model prompts and caches fetched content locally, so users should review it before installing.

Install only if you are comfortable giving the skill a wcrss.com API key and having article fetches go to that service. Run it from a private, trusted working directory, clear the cache when needed, and avoid giving the summarizing agent unrelated secrets or powerful tools because article HTML may contain adversarial instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:66
Finding

Indirect prompt injection through untrusted article HTML

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wechat_rss.py:10
Finding

Plaintext cache uses a predictable relative path and follows symbolic links

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tainted flow: 'headers' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wechat_rss.py (reported line 50)May include surrounding context.

python
url = f"https://api.wcrss.com/sapi/articles?recentDays={recent_days}&num={num}"
    headers = {"Authorization": f"Bearer {api_key}"}
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill invokes Python scripts that read environment variables, perform network access, and likely use local file reads/writes for caching, but the manifest declares no explicit tool scope or permissions. This weakens sandboxing and user/operator awareness, increasing the risk that the skill can access sensitive resources beyond what is clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill states that it reads an API key from WCRSS_API_KEY and calls the third-party wcrss.com API, but it does not clearly disclose what user data, prompts, or derived content may be transmitted externally. Users may unknowingly cause article queries or related data to be sent to a third party without informed consent, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The embedded prompt explicitly requires Chinese output (e.g., '请从以下文章内容中提取关键要点') and the display template is also Chinese-only, but the file does not offer the user a language/locale option. That creates a language policy concern because the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The function docstring and implementation hard-code article timestamps to UTC+8, which imposes a specific locale/timezone behavior on all users. This is a natural-language policy concern because the file does not offer user opt-in or explain that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_rss.py (reported line 47)May include surrounding context.

python
print(f"Using cached data (age: {int(current_time - cache_time)}s)")
            return cached_data

    url = f"https://api.wcrss.com/sapi/articles?recentDays={recent_days}&num={num}"
    headers = {"Authorization": f"Bearer {api_key}"}
    try:
        response = requests.get(url, headers=headers, timeout=30)