ClawHub
Back to skill

Security audit

财经热点新闻爬取与话题归纳系统

Security checks for vulnerabilities and agentic risk

Overview

This finance-news skill has a coherent purpose, but it performs under-scoped high-impact actions such as automatic recursive cleanup, credential reuse, browser-profile reuse, shell command execution, and automatic opening of generated HTML reports.

Review before installing. Use only in an isolated workspace with dedicated output directories, a dedicated low-quota API key, and no personal browser profile. Do not run it on machines where configurable cleanup paths could point at important files, and avoid opening generated HTML reports from untrusted scraped/model content until escaping and URL validation are fixed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
module4_report_generator.py:421
Finding

Stored HTML Injection Through Unsanitized News and Model Content

Content
View full analysis
{news['rank']}
{news['title']}
{news['source']} 热度: {news['score']:.1f}分 {news['publish_time']}
{news['summary']}
关键词: {keywords_html}
""" if news.get('url'): hot_news_html += f""" """ deep_reports_html = "" for report_data in deep_reports: analysis_text = report_data.get('analysis', '无分析内容') analysis_html = "" for line in analysis_text.split('\n'): if line.strip(): analysis_html += f"

{line}

" deep_reports_html += f"""
TOP{report_data['rank']}
{report_data['title']}
{report_data['source']} 评分: {report_data.get('score', 0):.1f}
...[truncated 3169 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
summarize_utils.py:172
Finding

PowerShell Command Injection Through Configurable Summarization Values

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
module2_summarize_filtered.py:741
Finding

Undisclosed Reading and Delegation of OpenClaw API Credentials

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
module3_news_flash.py:100
Finding

Automatic Reuse of a Full Local Browser Profile

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
main.py:597
Finding

Unrestricted Recursive Deletion Through Configurable Directories

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (78)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code automatically triggers deletion of files older than 24 hours from temp and reports locations without confirmation. In the context of a news-crawling/reporting skill, destructive file operations are not essential and can lead to silent loss of user data or prior outputs if directory scope is broader than intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module executes an external command-line scraping tool even though its documented purpose is just to crawl news sites. Spawning an external binary materially expands the execution surface: behavior depends on PATH resolution and the installed tool, which could be replaced, tampered with, or have unexpected capabilities beyond simple HTTP fetching.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · module2_summarize_filtered.py (reported line 361)May include surrounding context.

python
- impact: 影响分析（50-100字）
- outlook: 未来展望（50-100字）"""
        
        return prompt
    
    def summarize_with_cli(self, prompt: str) -> Optional[Dict[str, Any]]:
        """使用summarize CLI进行归纳（从配置文件读取API key和URL）"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · rate_news_new.py (reported line 389)May include surrounding context.

python
- impact: 影响分析（50-100字）
- outlook: 未来展望（50-100字）"""
        
        return prompt
    
    def summarize_with_cli(self, prompt: str) -> Optional[Dict[str, Any]]:
        """使用summarize CLI进行归纳（从配置文件读取API key和URL）"""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The tool invocation uses shell=True unnecessarily for a simple version check. In a skill context that may run on user systems, this increases the risk of executing an attacker-controlled binary from PATH or invoking the shell in ways that are hard to reason about.

Content

Scanner excerpt · module2_summarize_filtered.py (reported line 807)May include surrounding context.

python
# 检查summarize命令是否可用
            try:
                import subprocess
                result = subprocess.run(['summarize', '--version'], 
                                       capture_output=True, text=True, timeout=5, shell=True)
                summarize_available = result.returncode == 0
            except Exception:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The deep-analysis tool call accepts externally sourced URLs and runs an external summarizer with credential-bearing environment variables. In this skill context, that is more dangerous because article content can be attacker-influenced, causing untrusted data to reach a powerful external tool and remote service without clear user consent.

Content

Scanner excerpt · module2_summarize_filtered.py (reported line 841)May include surrounding context.

python
print(f"    环境变量: OPENAI_API_KEY={deepseek_api_key[:10]}...{deepseek_api_key[-4:] if deepseek_api_key else '未设置'}")
                    print(f"               OPENAI_BASE_URL={deepseek_base_url}")
                    
                    result = subprocess.run(
                        cmd,
                        capture_output=True,
                        text=True,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Using subprocess.run with shell=True on a composed command string is a classic command-injection sink. In this skill context, the URL ultimately comes from configuration or inputs, so a maliciously crafted value could escape the intended command and execute arbitrary commands on the host.

Content

Scanner excerpt · module3_news_flash.py (reported line 293)May include surrounding context.

python
# 计算超时时间（秒），使用配置的超时时间
                timeout_seconds = timeout_ms / 1000 + 5  # 增加5秒缓冲
                
                result = subprocess.run(
                    cmd, 
                    shell=True, 
                    capture_output=True,

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · module2_summarize_filtered.py (reported line 381)May include surrounding context.

python
print(f"[INFO] 执行summarize命令: {' '.join(cmd[:3])}... [文件:{temp_file_path}]")
                
                # 添加API密钥环境变量
                env = os.environ.copy()
                env['OPENAI_API_KEY'] = self.default_config['api_key']
                env['OPENAI_BASE_URL'] = self.default_config['api_base_url']

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · module2_summarize_filtered.py (reported line 832)May include surrounding context.

python
print(f"[INFO] 执行summarize命令: {' '.join(cmd[:3])}... [文件:{temp_file_path}]")
                
                # 添加API密钥环境变量
                env = os.environ.copy()
                env['OPENAI_API_KEY'] = self.default_config['api_key']
                env['OPENAI_BASE_URL'] = self.default_config['api_base_url']

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · summarize_utils.py (reported line 193)May include surrounding context.

python
print(f"[INFO] 执行summarize命令: {' '.join(cmd[:3])}... [文件:{temp_file_path}]")
                
                # 添加API密钥环境变量
                env = os.environ.copy()
                env['OPENAI_API_KEY'] = self.default_config['api_key']
                env['OPENAI_BASE_URL'] = self.default_config['api_base_url']

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The title, trigger phrases, and primary invocation guidance are entirely in Chinese, and the trigger conditions require specific Chinese phrases. The file does not offer alternative language support or state that the skill is intentionally restricted to a Chinese-language or region-specific context, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README documents execution steps that perform live network scraping and explicitly references Playwright-based browser automation, but it does not present a prominent user-facing warning before execution that the skill will access external sites and may automatically launch a browser. In an agent-skill context, missing disclosure can lead to unexpected outbound network activity and UI side effects, reducing informed consent and increasing operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation lists concrete output directories on the local filesystem where scraped data, summaries, logs, and reports are written, but it does not clearly warn users that running the skill will persist data locally. This can cause unanticipated storage of potentially sensitive browsing-derived content on disk, especially in shared or managed environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises 'automatic cleanup of old data' but does not clearly disclose what files or directories may be deleted, under what conditions, or how the cleanup scope is constrained. In an agent-executed workflow that runs shell and Python commands, undocumented deletion behavior can cause unintended data loss, especially if configuration mistakes or path-handling bugs broaden the cleanup target.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cls_hot_news.py (reported line 57)May include surrounding context.

python
# 如果scrapling_util不可用，检查命令行版本
        try:
            result = subprocess.run(["scrapling", "--help"], capture_output=True, text=True, timeout=5)
            return result.returncode == 0 or "Usage:" in result.stdout or "Usage:" in result.stderr
        except:
            return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cls_hot_news.py (reported line 88)May include surrounding context.

python
tmp_file = tmp.name
            
            cmd = ['scrapling', 'extract', 'fetch', url, tmp_file, '--wait', str(wait_time), '--timeout', '15000']
            result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', timeout=30)
            
            if result.returncode == 0:
                with open(tmp_file, 'r', encoding='utf-8') as f:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · jrj_hot_news.py (reported line 66)May include surrounding context.

python
# 如果scrapling_util不可用，检查命令行版本
        try:
            result = subprocess.run(
                ["scrapling", "--help"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · stcn_hot_news.py (reported line 70)May include surrounding context.

python
# 如果scrapling_util不可用，检查命令行版本
        try:
            result = subprocess.run(
                ["scrapling", "--help"],
                capture_output=True,
                text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function makes outbound network requests to a third-party site and explicitly uses a stealth scraping mechanism, but the code does not provide a meaningful disclosure that external requests will be made or that request metadata may be transmitted. The top-level description states that scrapling is used, but it does not warn users about the network/privacy implications of contacting the remote site.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · jrj_hot_news.py (reported line 121)May include surrounding context.

python
]
            
            # 执行命令
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · stcn_hot_news.py (reported line 144)May include surrounding context.

python
]
            
            # 执行命令
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When live scraping fails, the crawler silently returns fabricated sample articles that look like real output. This can mislead downstream systems or users into acting on false data, undermining integrity and potentially contaminating automation, analytics, or trading workflows that expect authentic JRJ news.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code persistently saves scraped article contents, URLs, metadata, and generated reports to disk, but there is no confirmation prompt before writing and no warning in comments/docstrings that user data will be stored locally by default. For a code file, file writes should have some form of disclosure unless clearly covered by the skill description; here the docstring describes crawling but does not warn about saving outputs to local storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s docstrings, log messages, CLI description, and user-facing output are entirely in Chinese, which imposes a language choice on users without opt-in or alternatives. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstring for run_module3 states '只支持playwright模式' (only supports playwright mode), yet the top-level run method is declared with module3_mode='single' and forwards that value to run_module3 at L680. This is an active contradiction between the documented intent and actual callable behavior, even if CLI parsing later defaults to playwright.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.