网络安全情报爬虫

• Outcome: Review
• Latest audit: May 28, 2026 · 5:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed security-news and vulnerability crawler, but it uses sensitive credentials and recurring automation with several under-scoped or unsafe details that users should review first.

Install only if you are comfortable granting IMA note-writing credentials, recurring crawler behavior, and possible use of a MiniMax key from local OpenClaw config. Before use, remove the openclaw.json fallback or make it explicit, avoid hardcoded credentials, enable TLS verification, and add clear controls to enable, disable, and inspect any cron job.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities including environment-variable access, file read/write, network access, and shell execution, but no permissions are declared. This creates a transparency and consent gap: a user or orchestrator may invoke the skill without understanding that it can touch credentials, local files, scheduled tasks, and external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest presents this as a security-news RSS crawler, but the documentation adds a separate vulnerability-intelligence pipeline, external translation via MiniMax, additional data sources, credential access, and writes to separate notebooks/logs. That mismatch undermines informed consent and can conceal materially broader data access and outbound transfers than a user would expect.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation introduces a second crawler for vulnerability intelligence that is outside the stated purpose of the skill. Hidden or secondary workflows are risky because they expand network access, data collection, and storage behavior beyond the user's likely expectations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Automatic translation through MiniMax is an outbound data-sharing capability not justified by the declared RSS-fetching scope. Even if the translated content is public CVE text, the added third-party dependency changes the trust boundary and may expose metadata, usage patterns, or future non-public content.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The credential section is internally inconsistent: it says environment variables are required but also says they are hardcoded in run.sh. This signals weak secret-handling practice and increases the likelihood that credentials are embedded in scripts, exposed to logs, or mishandled during maintenance.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill adds a third-party LLM translation channel unrelated to the minimum needed to fetch and store feeds. This causes externally sourced vulnerability descriptions and titles to be transmitted to a separate provider, increasing data-sharing surface and creating prompt-injection and privacy risks from untrusted feed content.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code silently reads a MiniMax API key from a project-level openclaw.json if no environment variable is set. Reading secrets from unrelated local configuration broadens privilege beyond the crawler's stated purpose and can lead to unauthorized use of credentials the operator did not intend this skill to consume.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger conditions are broad enough to activate on general requests about viewing or managing crawler tasks, which could cause the skill to run or expose operational controls in situations where the user did not clearly request execution. Broad activation increases the chance of unintended scheduled-task interaction or data modification.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation includes a destructive rm command to reset the deduplication database without any warning about data loss, reprocessing, or downstream effects. Users or agents may execute it casually, causing duplicate ingestion, loss of state, or unnecessary network activity.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The docs enumerate credential-bearing environment variables and indicate hardcoded credentials may exist, but provide no security warning or handling guidance. This materially raises the risk of secret exposure through scripts, shell history, process listings, logs, screenshots, or source control.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script reads sensitive credentials from a local config file without user disclosure or clear scoping. In a plugin/skill context, silently harvesting project-level secrets is dangerous because it can repurpose existing credentials for new outbound API usage without informed consent.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: SSL verification is explicitly disabled when fetching the cxsecurity feed. This permits man-in-the-middle interception and tampering, allowing an attacker on the network path to inject arbitrary feed content that will be parsed, translated, logged, and stored in IMA notes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: SSL verification is disabled for the anquanke feed as well, creating the same MITM risk. Because fetched content is later sent to a third-party translation API and persisted into notes, transport tampering can cascade into misinformation, prompt injection attempts, and unwanted external data disclosure.

Session Persistence

Medium

• Category: Rogue Agent

Content

| 查看日志 | `cat ~/.openclaw/workspace/logs/sec_news_cron.log` |
| 查看上次运行状态 | `cat ~/.openclaw/workspace/data/sec_news_last_run.json` |
| 重置去重库（重新抓取所有文章） | `rm ~/.openclaw/workspace/data/sec_news_seen.json` |
| 查看 cron 配置 | `crontab -l \| grep sec_news` |
| 手动触发 cron | `run-parts /etc/cron.hourly`（系统级）|

## 添加/移除 RSS 源

• Confidence: 76% confidence
• Finding: crontab -l

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 手动执行一次 | `bash ~/.openclaw/workspace/skills/sec-news-crawler/scripts/run.sh` |
| 查看日志 | `cat ~/.openclaw/workspace/logs/sec_news_cron.log` |
| 查看上次运行状态 | `cat ~/.openclaw/workspace/data/sec_news_last_run.json` |
| 重置去重库（重新抓取所有文章） | `rm ~/.openclaw/workspace/data/sec_news_seen.json` |
| 查看 cron 配置 | `crontab -l \| grep sec_news` |
| 手动触发 cron | `run-parts /etc/cron.hourly`（系统级）|

• Confidence: 91% confidence
• Finding: rm ~/.openclaw/workspace/data/

VirusTotal

1/66 vendors flagged this skill as malicious, and 65/66 flagged it as clean.

Static analysis

No suspicious patterns detected.