Rss To Social

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:12 AM UTC
• Version: 1.2.0

Overview

This skill is not clearly malicious, but it overstates automatic social posting and requests high-impact account credentials without enough scoping or safeguards.

Review before installing. Use only trusted public feed URLs, run it with restricted network access if possible, do not provide Twitter or LinkedIn credentials unless the skill is updated to clearly implement and scope direct posting, and treat generated posts as drafts until you have explicit publication controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rss_monitor.py:68

Finding

Unrestricted RSS Feed Retrieval Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Dependency Allows Unreviewed Future Package Versions

Content

View full analysis

=6.0.0 ``` ### Technical Analysis The dependency declaration establishes only a minimum version. A fresh installation may therefore select any later `feedparser` release available from the configured package index. This makes installations non-reproducible and allows dependency code that was not part of the audited project version to enter the runtime automatically. The reviewed package name does not show evidence of typosquatting or dependency confusion, and no malicious dependency was confirmed. The risk arises from permitting future, unreviewed versions rather than from demonstrated malicious behavior in the currently available package. Because `feedparser` processes externally supplied feed content and runs within the Skill process, defects or compromise in a subsequently resolved release would inherit the process's filesystem and network access. ### Attack Path 1. The Skill is installed in a new environment after a later compatible package version becomes available. 2. The package installer resolves that later version because the requirement permits every version at or above `6.0.0`. 3. The later release contains a security vulnerability, compromised code, or an incompatible behavioral change. 4. The dependency code executes when the Skill parses attacker-controlled or otherwise untrusted RSS content. 5. Any resulting impact occurs with the permissions and network access of the Skill process. This is a supply-chain hardening weakness rather than evidence that the named dependency is currently malicious. ### Impact Assessment A compromised or vulnerable future dependency could potentially access the same resources as the Python process, including: - Configured RSS endpoints and outbound network connectivity. - Files accessible to the ...[truncated 310 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill makes strong claims about AI generation, automatic scheduling, and direct publishing to Twitter/LinkedIn, but the analyzed content does not substantiate those behaviors. This mismatch is dangerous because users may provide credentials or authorize automation under false assumptions about what the skill actually does, reducing informed consent and making later code changes harder to scrutinize.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes autonomous posting to social accounts but does not prominently warn users that it may publish externally, act on a schedule, and use account credentials. In this context, silent or underexplained automation is risky because it can affect public-facing accounts, brand reputation, and privacy with little friction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Test mode claims that no posts will be saved, but it still calls fetch_feeds(), which updates last_check and writes posted.json. This hidden state change can suppress or alter future behavior, causing integrity issues in scheduling/deduplication and violating user expectations about dry-run safety.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents capabilities that rely on environment access and persistent local state (for example API tokens and .rss-to-social/posted.json) but does not declare an explicit tool scope or permissions boundary. That omission makes the skill's effective access less transparent to users and reviewers, increasing the chance of over-broad execution or unexpected file/env access when installed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill asks users to configure sensitive Twitter and LinkedIn tokens without any nearby guidance on secret handling, storage, rotation, or the privacy implications of direct posting. This can lead users to expose high-value credentials in insecure environments or grant posting power without understanding the consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad everyday instructions like 'Check RSS feeds and post latest content' and 'Start RSS monitoring and auto-posting every 4 hours,' which could be activated by normal conversation rather than deliberate invocation. In a skill that can publish externally, ambiguous triggers increase the risk of accidental activation and unintended posting workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code writes posting history to disk in .rss-to-social/posted.json, which affects local user data/state. Although the function has a docstring, there is no user-facing disclosure at the point of operation or in runtime output that the skill persists URLs and timestamps locally, so users may not realize data is being stored.

Content

No source excerpt is available for this finding.

Tainted flow: 'history_file' from os.getenv (line 37, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/rss_monitor.py (reported line 38)May include surrounding context.

python

"""Save history of posted items"""
    ensure_data_dir()
    history_file = DATA_DIR / 'posted.json'
    with open(history_file, 'w') as f:
        json.dump(history, f, indent=2)

def get_url_hash(url):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that monitors RSS feeds and publishes content to Twitter/LinkedIn. In the implementation, send_to_openclaw explicitly states it only outputs posts for review and the rest of the code treats that as completion, so the actual behavior is preparation/display rather than publication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document is primarily in English but ends with a Chinese-only support section, without indicating language options or that multilingual content is intentional. This can violate language or locale consistency expectations for users who did not opt into Chinese content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as feedparser>=6.0.0, which allows installation of any future major or minor release and makes builds non-reproducible. This increases supply-chain risk and can unintentionally pull in vulnerable or breaking versions over time, especially in an automation skill that fetches external content and may run unattended.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

feedparser>=6.0.0

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

The manifest references feedparser without pinning a specific version, while the package has multiple known advisories across its history. Because the installed version is not fixed, there is no assurance that deployment will avoid affected releases; in a skill that ingests untrusted RSS content, parser-related flaws could be more relevant than in a purely internal tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The script performs network access by fetching each configured RSS feed URL. While the script title suggests monitoring feeds, there is no explicit user warning that all URLs supplied via RSS_FEED_URLS will be contacted and their metadata processed, which is relevant for privacy and network-awareness.

Content

No source excerpt is available for this finding.