ClawHub
Back to skill

Security audit

HackerNews数据服务

Security checks across malware telemetry and agentic risk

Overview

This HackerNews skill is routed through an unrelated xiaobenyang.com backend and persistently stores an API key, with enough naming and disclosure mismatches that users should review it before installing.

Install only if you trust xiaobenyang.com with your API key and HackerNews queries. Expect the key to be stored locally in a .env file as XBY_APIKEY, and review or remove that file when you no longer want the skill to retain access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill document instructs the agent to read environment configuration, persist a supplied API key, and call remote network services, yet no explicit permission declaration is present. This creates a transparency and governance problem: a host may grant more capability than the user expects, and the skill can access files, environment data, and the network without clear upfront disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims to provide HackerNews search/retrieval, but it also requires collecting and storing a user API key, depends on an unrelated third-party site, and does not clearly disclose that results are brokered through a remote intermediary rather than direct HackerNews access. This mismatch can mislead users about trust boundaries, credential exposure, and where their queries are actually sent.

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
A documentation example references an unrelated tool (`search_schools`) in a HackerNews skill, indicating copy-paste drift and weakening confidence that the documented routing behavior matches the implemented behavior. In security-sensitive agent skills, inconsistent tool references can cause the model or operator to invoke the wrong function set or misunderstand what data is being accessed.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The configuration clearly targets a different product than the declared HackerNews service: it uses a gaokao-specific env prefix, comments, and an unrelated base URL/domain. This kind of service/identity mismatch is dangerous because it can cause agents or operators to send credentials and requests to an unexpected backend, creating a supply-chain style trust failure and increasing the risk of secret exfiltration or unintended data access.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The docstring and comments describe a different gaokao skill than the advertised HackerNews service, which is a strong indicator of copied or repurposed code. In a security-sensitive config module, this mislabeling undermines operator trust and can conceal that secrets are being collected for an unrelated service or that requests will be routed somewhere unexpected.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to ask the user for an API key and persist it via configuration without clearly warning that the credential will be stored locally or explaining retention and access boundaries. This can lead to inadvertent long-term storage of secrets, reuse across sessions, or exposure to other tools/processes on the same host.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill explicitly directs the agent to display raw API data, while the documented HackerNews user profile content may contain HTML and remote content is inherently untrusted. Rendering or passing through raw content without sanitization increases the risk of unsafe HTML display, prompt injection through retrieved text, or accidental exposure of unexpected fields returned by the backend.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code persistently stores an API key into a local .env file without any confirmation, warning, permission check, or file permission hardening. That creates a credential exposure risk because users or agents may assume the key is session-only, while it is actually written to disk where it can be read by other local processes, accidentally committed, or captured in backups.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
83% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic>=2.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
pydantic-settings>=2.2.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
95% confidence
Finding
python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
90% confidence
Finding
requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
82% confidence
Finding
python-dotenv==1.0.1

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.