ClawHub
Back to skill

Security audit

Daily Ai News

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly gathers public AI news, but it needs review because its documentation overstates web-search support and includes credential setup plus automated channel posting with ambiguous targeting.

Review before installing. Use this only if you are comfortable with public network requests and optional posting to OpenClaw channels. Avoid the cron example that targets the last contacted channel; choose an explicit destination. Do not paste real API keys into an echo command, and review or pin any separate Tavily community skill before installing it. Expect Chinese output and do not rely on the bundled script for Brave/Tavily web search unless that support is added or separately verified.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Community Skill Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

API Key Is Persisted Through an Unsafe Shell Command

Content
View full analysis
> ~/.openclaw/.env ``` ### Technical Analysis The documented command requires the user to place the API key directly in a shell command. The resulting command may be retained in shell history, terminal logs, session recordings, or support transcripts. The command also appends the credential to `~/.openclaw/.env` without verifying that the file is owned by the intended user or protected with restrictive permissions. Actual exposure through file permissions depends on the existing file mode and the user's `umask`, but the instruction does not establish a secure mode. Repeated execution can also create multiple entries, leaving stale credentials in the file. The audited Python implementation does not read `TAVILY_API_KEY` or send it over the network. Therefore, the static pre-scan concern about direct secret exfiltration by this repository is not substantiated. The confirmed issue is insecure local secret handling in the documentation. ### Attack Path 1. A user replaces the example value with a real Tavily API key and executes the documented command. 2. The command containing the literal key is recorded in shell history or related terminal telemetry. 3. Alternatively, the resulting `.env` file is created or retained with permissions that allow another local account or process to read it. 4. An attacker with access to the history, telemetry, backup, or file retrieves the API key. 5. The attacker uses the key against Tavily under the victim's account, consuming quota and accessing any capabilities associated with that credential. ### Impact Assessment Successful exploitation exposes the Tavily API key. An attacker could consume the account's search quota, cause service charges where applicable, trigger rate limiting, or impersona ...[truncated 257 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ai_news.py:118
Finding

ArXiv Feed Is Retrieved over Unencrypted HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior materially differs from the analyzed implementation: it claims Brave/Tavily web search and GitHub Trending, but the code reportedly lacks real web-search support, uses a different GitHub source, and includes outbound channel sending not clearly declared as a core behavior. Behavior mismatches are dangerous because users may authorize the skill under false assumptions, especially when it can transmit content to external channels.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

  1. 配置环境变量：
bash
echo 'TAVILY_API_KEY=tvly-你的key' >> ~/.openclaw/.env

Brave Search 配置

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/ai_news.py (reported line 106)May include surrounding context.

python
['max_github']]:
        name = item.get('full_name', '')
        desc = item.get('description', '') or 'No description'
        stars = item.get('stargazers_count', 0)
        url = item.get('html_url', '')
        
        # 过滤非 AI 项目
        if not contains_ai_keywords(name + ' ' + desc):
            continue
            
        results.append({
            'name': name,
            'description': truncate(desc, 80),
            'stars': stars,
            'url': url,
            'source': 'GitHub'
        })
    
    return results[:CONFIG['max_github']]

def fetch_arxiv_papers():
    """获取 ArXiv AI 论文"""
    # 搜索 CS.AI 和 CS.LG 类别的最新论文
    categories = "cat:cs.AI+OR+cat:cs.LG+OR+cat:cs.CL"
    url = f"http://export.arxiv.org/api/query?search_query={categories}&sortBy=submittedDate&sortOrder=descending&max_results={CONFIG['max_arxiv']*2}"
    
    xml_data = fetch_text(url)
    if not xml_data:
        return []
    
    try:
        root = ET.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented trigger phrases are broad natural-language requests such as asking for AI news or a tech digest, which can overlap with ordinary user conversation and increase the chance of unintended skill invocation. In this skill’s context, accidental activation could cause unsolicited external fetching or message posting behavior, especially when paired with automation features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to configure automatic delivery to the 'last' contacted channel, but it does not clearly warn that content may be posted into whatever conversation was most recently active. This creates a real risk of unintended disclosure, spam, or posting into sensitive/private channels due to ambiguous targeting in an automated scheduled job.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises required tools under metadata, but it does not declare a clear restrictive tool scope such as permissions or allowed-tools. In an agent environment, missing explicit scope can let the skill execute with broader network or shell access than users expect, increasing the blast radius if the skill is modified or invoked unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Broad trigger phrases like general AI-news or tech-news requests can overlap with ordinary user conversations and cause the skill to activate when the user did not intend to call it. Because this skill performs network access and may support outbound sharing, accidental activation can lead to unnecessary data exposure or unexpected actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation promotes automatic sharing to chat channels but does not prominently warn that content will be transmitted outward to another destination. In a news-aggregation skill, users may assume output stays local to the current session, so undocumented outbound delivery increases the risk of accidental disclosure and misuse in automated cron jobs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code embeds user-facing comments, output headers, and status text in Chinese, and the generated digest is always formatted in Chinese. That creates a language policy issue because the skill does not offer any language or locale choice or document a justified region-specific restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ai_news.py (reported line 87)May include surrounding context.

python
def fetch_github_trending():
    """获取 GitHub AI 趋势项目"""
    # GitHub trending 没有官方 API，使用搜索 API 找最近更新的热门项目
    url = "https://api.github.com/search/repositories?q=AI+OR+LLM+OR+GPT+created:>2025-12-01&sort=stars&order=desc&per_page=20"
    
    data = fetch_json(url)
    if not data or 'items' not in data:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for fetching and presenting AI news from several sources, which justifies outbound HTTP requests to those data providers. However, the code also implements a separate delivery capability that sends the generated digest to arbitrary OpenClaw channels via the CLI, which goes beyond simple aggregation and retrieval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

For a daily AI news aggregator, fetching remote content and formatting a digest are expected capabilities. Spawning a subprocess to invoke an external messaging command introduces a broader action capability unrelated to collecting or summarizing news unless the manifest explicitly includes message delivery behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_news.py (reported line 208)May include surrounding context.

python
cmd.extend(["--channel", channel])
    
    # 使用 stdin 传递消息
    result = subprocess.run(
        cmd,
        input=message,
        capture_output=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

Most user-facing instructions and example prompts are written in Chinese, which implies a fixed language experience. The file does not state that the skill is Chinese-only, region-specific, or that users may choose another language, so this may violate a language/locale policy requiring user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.