ClawHub
Back to skill

Security audit

热点聚合服务

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its hotspot-aggregation purpose, but it persistently stores an API key in a local .env file and includes an arbitrary URL crawling feature that should be reviewed before use.

Review before installing. Use a dedicated Xiaobenyang API key with limited value, avoid installing in a source-controlled project unless .env is ignored, rotate the key if exposed, and do not use crawl_website with private, internal, or sensitive URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation indicates capabilities to read environment variables, read/write local files, and make network requests, but it declares no permissions or equivalent user-facing capability disclosure. This weakens informed consent and increases the chance that sensitive actions such as API-key persistence or outbound requests occur without adequate visibility or policy enforcement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is hotspot aggregation, but the documented behavior also includes persisting API keys to local configuration, reading secrets from local/env sources, and arbitrary website crawling. This mismatch is dangerous because users may grant trust based on a narrow description while the skill actually has broader data-handling and network capabilities than expected.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
Including an arbitrary website crawling tool in a skill marketed as a hotspot aggregation service expands the attack surface beyond the declared scope. Even if intended for convenience, this can enable unexpected retrieval of third-party content, privacy issues, and misuse of the skill for unrelated network access.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The crawl_website capability is broad and not clearly necessary for trend aggregation, so it introduces functionality that can be repurposed for unrestricted external content retrieval. In context, that makes the skill more dangerous because users expecting curated trend sources may unknowingly authorize arbitrary outbound requests.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a hotspot aggregation service, but it also exposes a generic website crawling function that can fetch arbitrary URLs via an external API. This broadens the trust and capability boundary beyond the stated purpose, creating SSRF, internal resource access, or unintended data exfiltration risk if callers can supply untrusted URLs.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The custom RSS capability materially expands the skill from fixed-source trend aggregation into generic remote content ingestion. That mismatch can let users fetch attacker-controlled feeds or unexpected content through the backend, increasing exposure to malicious input, privacy issues, and capability confusion.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to ask for an API key and persist it locally, but it does not clearly warn the user that their credential will be stored in local configuration. This is dangerous because users may disclose secrets without understanding retention, exposure risk, or how to revoke/remove the stored key.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation exposes arbitrary website crawling and third-party content retrieval without clear privacy, data-transfer, or network-use warnings. Users may provide URLs or request content from external sites without understanding that the skill will contact those domains and potentially process sensitive or identifying data.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code persists the API key into a local .env file and also places it into the process environment automatically, without any user confirmation or storage-safety controls. Persisting secrets to disk increases exposure through accidental commits, permissive file permissions, backups, logs, or local compromise.

Missing User Warnings

High
Confidence
94% confidence
Finding
The crawl_website function forwards a user-supplied URL to an external API without any visible validation or warning. If the backend crawler follows arbitrary URLs, an attacker could induce requests to sensitive internal services, metadata endpoints, or private hosts, and users may unknowingly transmit confidential URLs to a third party.

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
82% confidence
Finding
This function writes the API key into a plaintext .env file, creating persistent local storage of a credential. In the context of an agent skill, that is more dangerous because skills may run in shared workspaces or developer environments where .env files can be exposed via source control mistakes, backups, or other tooling.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
93% confidence
Finding
The dependency is specified with a lower-bound range (`requests>=2.31.0`) instead of an exact pin, which makes builds non-reproducible and can unexpectedly pull in newer releases with breaking changes or newly introduced supply-chain risk. In a network-facing aggregation service that fetches external content, dependency drift increases operational and security uncertainty.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
92% confidence
Finding
`pydantic>=2.7.0` is unpinned, so installations are not deterministic and may consume future versions that change behavior or introduce vulnerabilities. While this is generally a hygiene and supply-chain hardening issue rather than an immediate exploit, it is still a valid security weakness.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
92% confidence
Finding
`pydantic-settings>=2.2.0` allows any later version to be installed, which weakens reproducibility and increases exposure to accidental or malicious upstream changes. For an MCP-based service, predictable dependency resolution is important because configuration parsing behavior can affect runtime security posture.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
93% confidence
Finding
`python-dotenv>=1.0.1` is an unpinned dependency, so deployments may pull in unexpected versions and create supply-chain and reproducibility risk. Because this library commonly handles environment configuration, silently changing behavior can have security consequences even if the issue is indirect.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
89% confidence
Finding
The requirement `requests>=2.31.0` permits installation of `requests` 2.31.0, which has published advisories including credential leakage via malicious URLs and request verification issues. Since this skill is a hotspot aggregation service that likely fetches remote resources and processes untrusted URLs, the presence of a vulnerable allowed version is more relevant than it would be in an offline-only tool.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
82% confidence
Finding
The requirement `python-dotenv>=1.0.1` allows installation of version 1.0.1, which is flagged for a symlink-following arbitrary file overwrite issue in `set_key`. This is only exploitable if the application actually uses the vulnerable write path, which is not shown here, so the dependency risk is real but context-limited based on the file alone.

Static analysis

No suspicious patterns detected.