ClawHub
Back to skill

Security audit

HN Digest

Security checks for vulnerabilities and agentic risk

Overview

This skill can fetch Hacker News posts, but it also automatically generates an AI image using local credentials and runtime-installed packages, which is broader than its user-facing description suggests.

Install only if you are comfortable with every HN request also running an image-generation workflow, using Gemini/OpenClaw credentials, installing Python packages at runtime, making outbound API calls, and writing image/venv files under ./tmp. A safer version would make image generation opt-in, disclose required credentials and network use in the description, and pin dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_mood_nano_banana.sh:10
Finding

Unpinned Third-Party Dependencies Installed at Runtime

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_mood_nano_banana.sh, lines 10–14
Vulnerability Type: Supply-chain exposure through unpinned runtime dependencies
Risk Level: Medium

Vulnerable Code

sh
VENV_DIR="./tmp/hn-venv"
PY="$VENV_DIR/bin/python"

if [ ! -x "$PY" ]; then
  python3 -m venv "$VENV_DIR"
  "$PY" -m pip install --quiet --disable-pip-version-check google-genai pillow
fi

Technical Analysis

The script creates a virtual environment and installs the latest available releases of google-genai and pillow when invoked in a fresh environment. Neither exact versions nor package hashes are specified.

This means the code executed by the Skill is not fully represented by the reviewed repository. Package behavior can change after review, and a compromised upstream package release or package distribution channel could introduce malicious installation or runtime code. Python package installation may execute package-controlled build logic, while imported package code subsequently runs with the privileges of the Skill process.

The use of a virtual environment limits modification of the system Python installation, but it does not sandbox package installation or runtime behavior. Installed code retains access to files, environment variables, credentials, and network capabilities available to the invoking process.

Attack Path

  1. An attacker compromises an upstream dependency release or its distribution channel.
  2. The Skill runs where ./tmp/hn-venv/bin/python does not yet exist.
  3. The shell script creates the virtual environment.
  4. pip install resolves and downloads the current uncontrolled versions of google-genai, pillow, and their transitive dependencies.
  5. Malicious package build, installation, import, or runtime code executes.
  6. That code operates with the permissions and accessible credentials of the Skill process.

This path requires compromise of an upstream dependency or distribution mechanism; ...[truncated 741 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version.

  2. Lock all transitive dependencies using a reproducible lock file.

  3. Record and verify package hashes, then install with a command such as:

    sh
    "$PY" -m pip install --require-hashes -r requirements.lock

  4. Install dependencies during a controlled build or setup phase rather than during normal Skill invocation.

  5. Review dependency updates before changing locked versions.

  6. Use a trusted package index and restrict fallback to unintended indexes.

  7. Run image generation in a sandbox with:

    • Minimal filesystem access.
    • Only the required API credential.
    • Outbound network access restricted to necessary service endpoints.
    • A non-privileged operating-system account.

  8. Avoid suppressing installation output in security-sensitive environments so dependency resolution and failures remain auditable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares no permissions, yet its documented behavior invokes local scripts, reads environment/configured credentials, performs network access, and writes files. This is dangerous because it hides the true trust boundary from users and the platform, making capability review and consent ineffective and increasing the chance of unintended data access or external calls.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose is a simple Hacker News digest, but the procedure expands into image generation, dependency installation, credential access, external API usage, and filesystem writes. This mismatch is dangerous because it conceals materially different behaviors from users and reviewers, enabling unexpected credential exposure, third-party data transfer, and execution of side-effecting code under an innocuous description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script’s behavior materially diverges from the declared skill purpose of fetching and sending Hacker News posts. Instead, it builds a prompt from HN data and invokes an image-generation pipeline, which is a strong indicator of hidden or deceptive functionality inside a user-facing skill and undermines informed user consent about what code will run.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script silently creates a virtual environment, installs additional packages, and runs an unrelated AI image-generation workflow despite the skill being described as a simple HN digest sender. This mismatch increases supply-chain and execution risk because users or reviewers may approve the skill for benign news retrieval while it performs substantially different networked actions and executes extra code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script’s behavior is materially inconsistent with the declared hn-digest skill purpose: instead of fetching Hacker News posts, it generates images via an external API. In a skill package, this kind of capability mismatch is dangerous because it can hide undeclared data flows, costs, or side effects behind a benign description, reducing user and reviewer ability to make informed trust decisions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads an OPENAI_API_KEY and invokes an image-generation API even though the stated skill only fetches and sends HN links. This unjustified credential use expands the attack surface and can lead to unauthorized API usage, unexpected billing, and covert external processing under a misleading skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script accesses Gemini credentials from both an environment variable and a local OpenClaw config even though the declared skill is only supposed to fetch Hacker News posts. That mismatch strongly suggests hidden capability and unauthorized use of sensitive credentials for an unrelated external service, increasing the risk of covert API usage or abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding

The file implements image generation and file output via Gemini instead of the manifest-declared behavior of fetching and sending Hacker News front-page posts. A skill whose actual behavior materially differs from its advertised purpose is a high-risk supply-chain/deception issue because it can trigger unexpected network actions, consume paid APIs, and manipulate local files under false pretenses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The argument/help text and config references explicitly mention 'Nano Banana Pro' image generation, directly contradicting the HN digest description. This kind of internal branding mismatch is a strong indicator that unrelated code was embedded into the skill, which undermines trust boundaries and supports the likelihood of deceptive behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The trigger language goes beyond the explicit hn command and includes broad phrases like asking for HN or topic variants, which can cause accidental activation. In context, accidental activation is more dangerous because the skill does more than fetch text: it can run scripts, perform network calls, and generate files/images without a clearly intentional invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructions omit a clear user warning that it will invoke external scripts and create an image artifact in addition to sending posts. This is dangerous because users may believe they requested only a text digest, while the skill silently expands scope to third-party processing and local artifact generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Creating a virtual environment and installing packages at runtime without user-visible disclosure introduces unexpected code execution and supply-chain exposure. In isolation this is often a hygiene and transparency issue, but in this skill it is more concerning because the installs support functionality unrelated to the advertised purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script performs external network-dependent operations and executes generated tooling without any user-visible disclosure, which can expose data and trigger side effects the user did not request. This is more dangerous here because the networked actions are part of an undeclared image-generation pipeline rather than the advertised HN post delivery behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script transmits the supplied prompt and bearer credential to an external service without any user-facing disclosure or consent mechanism. Even if expected for image generation, this is risky in the context of an HN digest skill because prompts may contain sensitive user text and the external transmission is not aligned with the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script silently reads sensitive credentials from the environment and local config without any user-facing indication, despite those secrets being unrelated to the documented HN use case. Even if not exfiltrated here, undisclosed secret access violates least surprise and weakens the security posture by expanding secret exposure unnecessarily.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The code performs external network transmission to the OpenAI Images API. External transmission is not inherently unsafe, but in this skill context it is suspicious because the declared purpose is HN post retrieval, not image generation, so the outbound call represents an undeclared capability and data egress path.

Content

Scanner excerpt · scripts/mood_image.py (reported line 12)May include surrounding context.

python
def request_image(api_key: str, prompt: str, model: str, size: str, quality: str) -> dict:
    url = "https://api.openai.com/v1/images/generations"
    body = json.dumps(
        {
            "model": model,

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

Reading GEMINI_API_KEY from the environment is suspicious in this context because the skill claims to provide Hacker News digests, not interact with Gemini. In a mismatched skill, environment secret harvesting is especially dangerous because it enables unauthorized third-party API calls using credentials the user did not expect this skill to access.

Content

Scanner excerpt · scripts/nano_banana_mood.py (reported line 19)May include surrounding context.

python
"""

    # Prefer env var if set.
    env_key = (os.environ.get("GEMINI_API_KEY") or "").strip()
    if env_key:
        return env_key

Static analysis

No suspicious patterns detected.