ClawHub
Back to skill

Security audit

botlearn-rss-manager

Security checks for vulnerabilities and agentic risk

Overview

This RSS skill has a coherent purpose, but it directs broad outbound fetching and silent feed URL changes without enough safety boundaries for untrusted URLs.

Install only if you are comfortable with the agent contacting third-party feed and article URLs from its runtime. Before use, restrict accepted URLs to http/https, block localhost/private/metadata addresses, validate every redirect and discovered URL, limit response sizes and redirects, and require confirmation before permanently changing stored feed URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
strategies/main.md:11
Finding

Unrestricted Feed and Article URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
` in HTML `` 2. Check `` in HTML `` 3. Try common paths: `/feed`, `/rss`, `/atom.xml`, `/feed.xml`, `/rss.xml`, `/index.xml`, `/feeds/posts/default` (Blogger) 4. Check `/.well-known/` resources 5. Parse the page for embedded feed links in the body content ``` ### Technical Analysis The Skill instructs the Agent to perform HTTP requests against feed URLs supplied by users, process redirect targets, discover additional URLs from remote HTML, and f ...[truncated 3243 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list contains very generic terms such as 'feed', 'digest', and 'subscribe' that are common in many unrelated user requests. This can cause the skill to activate outside its intended RSS-management context, leading to unintended tool behavior, response hijacking, or interference with more appropriate skills.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 41)May include surrounding context.

md
2. Apply the appropriate phase from strategies/main.md based on the task

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · knowledge/anti-patterns.md (reported line 21)May include surrounding context.

md
- **Fix**: Resolve all elements by their full namespace URI (`http://purl.org/rss/1.0/modules/content/`), not the prefix string. Use a namespace-aware XML parser

### 3. Trusting Feed-Declared Encoding
- **Problem**: Accepting the XML declaration's encoding attribute (`encoding="UTF-8"`) without verification. Many feeds declare UTF-8 but actually serve Windows-1252 or ISO-8859-1, causing mojibake in non-ASCII characters
- **Fix**: Detect actual encoding using BOM detection and byte-pattern analysis. If detected encoding conflicts with declared encoding, trust the detection. Always validate that decoded text is valid Unicode before processing

### 4. Ignoring Content Type Negotiation

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation rule 'WHEN the user requests RSS feed management, digest generation, or feed subscription' is broad and does not define exclusion conditions or required RSS-specific signals. Because 'digest generation' and 'feed subscription' are ambiguous, the skill may activate on unrelated tasks, increasing the chance of unintended delegation and incorrect handling of user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The strategy directs the agent to make outbound HTTP requests to all subscribed feed URLs and to automatically persist URL changes on 301 redirects, but it does not require explicit user awareness, consent, or validation of redirect targets. In an RSS skill this behavior is functional, yet it can still expose the user's environment to unwanted external requests, tracking, SSRF-like access to internal endpoints if feed URLs are untrusted, or silent source changes that alter what is being monitored.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.