ClawHub
Back to skill

Security audit

Danish News Aggregator

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Danish RSS aggregator, but it has serious under-disclosed network-safety issues and overstates what the shipped code actually does.

Install only if you are comfortable reviewing or fixing the scripts first. Prefer running in a restricted environment, pin the Python dependencies, remove the TLS-bypass code, avoid HTTP feeds, restrict feeds.json to trusted HTTPS domains, and do not add the cron job until the behavior and output claims match what you expect.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
aggregate_feeds.py:58
Finding

TLS Certificate and Hostname Verification Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
aggregate_feeds.py:47
Finding

Unrestricted Configurable URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
aggregator.py:125
Finding

Untrusted Remote Feed Fields Are Directly Interpolated into Generated XML

Content
View full analysis
<![CDATA[{entry['title']}]]>
text
<link>{entry['link']}</link>
<description><![CDATA[{entry['summary']}]]></description>
<pubDate>{entry['published']}</pubDate>
<source>{entry['source']}</source>
<category>{feed_title}</category>

"""

text
rss = f"""<?xml version="1.0" encoding="UTF-8"?>
{feed_title} {feed_description} {feed_url} da {datetime.now().strftime('%a, %d %b %Y %H:%M:%S +0000')} Danish News Aggregator v1.0 {items} """ ```

Technical Analysis

Article titles, links, summaries, publication dates, and source names originate from remote feeds and are inserted into an XML document through string interpolation.

The link, pubDate, and source fields are not XML-escaped. XML metacharacters such as <, >, and & can therefore terminate or introduce elements. Although titles and descriptions are wrapped in CDATA sections, an attacker-controlled value containing the CDATA terminator ]]> can close the section and inject additional XML markup.

This can produce malformed output or alter the structure and semantics of the generated RSS document. The risk is amplified because the project retrieves remote content and includes at least ...[truncated 1430 chars]

Remediation
View remediation
` sequences.
  • Validate links and permit only expected https URLs before including them.
  • Normalize and validate publication dates before serialization.
  • Treat descriptions as untrusted content. If they are later rendered as HTML, sanitize them with a maintained allowlist-based HTML sanitizer at the rendering boundary.
  • Add regression tests containing &, <, >, quotes, and ]]> in every remotely sourced field.
  • Parse the generated document in tests to confirm it remains well-formed. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Third-Party Python Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code does implement a Danish news RSS aggregation function, so the broad theme matches. However, the declared description materially overstates the implementation. The script creates a single merged RSS feed, not six category-based feeds. It does not contain logic for categorization, deduplication, authority scoring, or scheduled refresh. It loads feeds from a JSON file or a default list of five sources, which is inconsistent with the claim of combining 100+ feeds. These are core product-behavior discrepancies rather than minor implementation details, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code substantially aligns with the general purpose of aggregating Danish RSS feeds into category-based RSS outputs, including deduplication and authority-based sorting. However, several material claims in the description are not implemented as stated. Most notably, there is no automatic 15-minute refresh mechanism, the feed count is far below the claimed 100+, and the output count is 7 feeds rather than 6 because the code generates an 'all' feed in addition to six category feeds. The specific claim that danish-all.xml combines the top 30 sources is also not implemented. These are significant enough to count as a description/behavior mismatch, even though the overall theme and primary function are related.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

  • ✅ Source authority ranking (DR > major newspapers > regional)
  • ✅ Time filtering (last 24h by default)
  • ✅ RSS 2.0 compliant
  • ✅ UTF-8 encoding
  • ✅ Auto-refresh (15 min interval)
  • ✅ Media RSS extensions for images

Hosting

Self-Host (Docker)

bash
docker build -t danish-news-aggregator .
docker run -d -p 8080:8080 danish-news-aggregator

Cron Job

bash
# Add to crontab
*/15 * * * * cd /path/to/aggregator && python3 aggregator.py

Subscribe

Add these URLs to your RSS reader:

Credits

Aggregates from: DR, Berlingske, Politiken, Information, Nordjyske, Fyens, JydskeVestkysten, Bold.dk, Tipsbladet, TV2 Sport, Finans, Nationalbanken, Vers

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a comprehensive aggregator that outputs six distinct feeds (all, national, regional, sports, business, tech, and English), deduplicates items, and ranks them by source authority. The implementation defines a single output file at L020 and in main/generate_rss only aggregates all fetched items into one RSS file sorted by parsed publication date, with no category partitioning, deduplication, or authority-ranking logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code disables TLS certificate validation and hostname checking for every feed fetch, which allows a man-in-the-middle attacker to intercept HTTPS connections and supply attacker-controlled RSS content. In this skill context, that can poison the aggregated output with falsified links, misleading news items, or malicious payloads embedded in feed fields while making the traffic appear trusted.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s natural-language strings and RSS metadata explicitly force a Danish locale, including the channel title/description and the RSS language tag set to "da". The policy requires either user opt-in for language constraints or clear documentation that the skill is intentionally region-specific; this file does neither within its user-facing behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The generated RSS always sets <language>da</language>, which imposes a specific locale in output content. The file also aggregates an explicit English category, so forcing Danish for all generated feeds is a natural-language locale policy issue rather than a purely technical default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill produces 6 curated RSS feeds, but the implementation builds seven files: danish-all.xml plus six category feeds. This is a direct mismatch between the stated outputs and the actual behavior of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest promises an auto-refreshing Danish news aggregator, which implies current feed output. This file contains much older articles from 2022 and 2020 alongside 2026 items, indicating the output is not purely current news as described.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes a Danish news RSS aggregator producing curated news feeds, which implies timely news content. This file includes evergreen feature content such as advice on making a good impression at a Danish home, which is not news and falls outside the described aggregation purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The function docstring says duplicates are removed based on title similarity, and an inline comment says to use link as key. The actual implementation only keeps entries with unique non-empty links, which contradicts the documented deduplication behavior and materially differs from the manifest's broader 'deduplicates' claim.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The RSS metadata explicitly sets the channel language to Danish via <language>da</language>. Under the stated policy, forcing a specific language without user opt-in or documented justification can be a locale-policy issue, and this file does not provide any such opt-in or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The title and description present the resource as exclusively Danish, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest says the skill produces 6 curated RSS feeds limited to all, national, regional, sports, business, tech, and English-language Denmark. This file documents additional source domains and content types including politics, universities, international coverage, podcasts, radio, and weather, which go beyond the stated category-based feed scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file states 'Total Feeds: 80+' while the manifest description claims the aggregator 'combines 100+ Danish RSS feeds.' These two intent statements are directly inconsistent about the skill’s advertised coverage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file identifies the skill as a "Danish News Aggregator" with a description focused on Danish RSS feeds, which imposes a Denmark-specific language/locale scope in the skill metadata. Because there is no accompanying opt-in, alternative locale handling, or documented justification in this file, this can be read as a locale policy constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill produces 6 curated feeds covering national, regional, sports, business, tech, English-language, plus an all-news feed, but this configuration includes additional categories such as domestic, foreign, politics, and weather. That indicates the configured source scope is broader than the described output taxonomy, creating a semantic mismatch between the advertised aggregation scope and the actual configured inputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.