ClawHub
Back to skill

Security audit

Cailianpress Unified

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches public Cailian Press news data and stores/query it locally, with no artifact-backed evidence of deception or unrelated access.

Install only if you want this skill to call public CLS endpoints and maintain a local CLS news database. Enable the suggested cron jobs deliberately, understand that old raw ingest logs may be pruned after 30 days, and consider pinning requests in a lockfile before production use.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
Confidence
95% confidence
Finding
The dependency is specified as requests>=2.31.0, which allows any future version to be installed. This makes builds non-reproducible and can unexpectedly introduce vulnerable or incompatible releases into the skill's environment, increasing supply-chain risk.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
The requirement references requests without constraining it to a version range known to exclude multiple disclosed CVEs. Because the specifier permits installation of affected versions, the environment may resolve to a vulnerable release, exposing the skill to issues such as credential leakage, TLS/verification flaws, or other request-handling weaknesses depending on usage.

Static analysis

No suspicious patterns detected.