news-content

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:25 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent news-extraction purpose, but its network code can expose the API key and submitted URLs through unsafe TLS and HTTP behavior.

Review before installing. Use only with non-sensitive public news URLs, avoid internal or private URLs, use a scoped/rotatable API key, and do not configure an `http:` backend. The publisher should remove disabled TLS verification, require HTTPS, document the exact remote data flow, and pin installation instructions before this is treated as low risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_news.js:30

Finding

TLS Certificate Verification Disabled for Authenticated API Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/extract_news.js, lines 30-35
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

js

const options = {
  headers: {
    'Authorization': API_KEY
  },
  rejectUnauthorized: false // 跳过 SSL 证书验证，解决 "unable to verify the first certificate" 错误
};

Technical Analysis

The HTTPS request explicitly sets rejectUnauthorized to false. This disables verification of the server's certificate chain and identity, allowing the client to accept expired, self-signed, or attacker-controlled certificates.

Because the request includes EASYALPHA_API_KEY in the Authorization header, an attacker capable of intercepting network traffic can impersonate the extraction server and obtain the credential. The attacker can also inspect submitted news URLs and modify the API response printed by the Skill.

Attack Path

1. A user invokes the Skill with a news URL.
2. The script establishes an HTTPS connection to the configured extraction server.
3. An attacker with a network interception position presents a forged or otherwise untrusted certificate.
4. The Node.js client accepts that certificate because certificate verification is disabled.
5. The client sends the API key and target news URL to the attacker's endpoint.
6. The attacker captures the credential and may return manipulated extraction content.
7. The untrusted response is printed as if it originated from the legitimate service.

Impact Assessment

A successful attacker can obtain the extraction service API key, monitor which URLs are submitted, and manipulate extraction responses. The exposed privileges are limited to those granted by the API key, but manipulated output may also affect downstream Agent behavior if it is treated as trusted content.

Remediation

View remediation

Remediation Suggestions

• Remove rejectUnauthorized: false and rely on Node.js certificate verification.
• Correct the server's certificate chain instead of bypassing validation.
• If a private certificate authority is required, configure a narrowly scoped trusted CA through the ca option.
• Avoid globally changing Node.js TLS verification settings.
• Add an automated test confirming that invalid, expired, and hostname-mismatched certificates are rejected.
• Rotate the API key if the vulnerable client has operated on an untrusted network.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_news.js:11

Finding

Configurable HTTP Endpoint Can Expose the API Key in Plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/extract_news.js, lines 11-39
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: High

js

const SERVER_URL = process.env.NEWS_EXTRACTOR_SERVER_URL || 'https://easyalpha.duckdns.org/api/v1/extract';
const API_KEY = process.env.EASYALPHA_API_KEY;

// 构造请求 URL
const targetUrl = new URL(SERVER_URL);
targetUrl.searchParams.append('url', urlToExtract);

const options = {
  headers: {
    'Authorization': API_KEY
  },
  rejectUnauthorized: false // 跳过 SSL 证书验证，解决 "unable to verify the first certificate" 错误
};

const client = targetUrl.protocol === 'https:' ? https : http;

const req = client.get(targetUrl, options, (res) => {

Technical Analysis

The server address is controlled by NEWS_EXTRACTOR_SERVER_URL, and the implementation deliberately supports both HTTPS and plaintext HTTP. No validation requires the configured endpoint to use HTTPS.

The same authorization header is attached regardless of the selected protocol. If the environment variable is accidentally or maliciously configured with an http: URL, the API key and requested news URL are transmitted without encryption or server authentication.

This issue is distinct from disabled certificate verification: even if HTTPS verification is corrected, the explicit HTTP fallback would continue to permit cleartext credential disclosure.

Attack Path

1. An attacker, compromised deployment configuration, or operator error changes NEWS_EXTRACTOR_SERVER_URL to an http: endpoint.
2. The script parses the value and selects Node.js's http client.
3. The script attaches EASYALPHA_API_KEY to the Authorization header.
4. The request crosses the network without encryption.
5. The endpoint operator or a network observer captures the API key and submitted URL.
6. The captured key can be reused against the extraction service to the extent permitted by that ...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

• Reject every endpoint whose protocol is not exactly https:.
• Validate the URL before constructing or sending any authenticated request.
• Remove the HTTP client fallback from production code.
• If local HTTP development is required, allow it only through an explicit development mode restricted to loopback addresses, and do not attach production credentials.
• Consider restricting endpoints to an approved hostname allowlist.
• Use separate, minimally privileged credentials for development and production.
• Add tests confirming that http:, unsupported protocols, and unapproved hosts fail closed.

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Installation Instructions Execute a Mutable Latest Package Release

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 13-17
Vulnerability Type: Unpinned executable supply-chain dependency
Risk Level: Medium

markdown

1. **Install from ClawHub**:
   Run the following command in your OpenClaw project directory:
   ```bash
   npx clawhub@latest install news-content-extractor
   ```

Technical Analysis

The documented installation command asks npx to download and execute the mutable latest release of clawhub. The code executed by that command can therefore change after this Skill has been reviewed, without any corresponding change to the audited project.

The audit found no evidence that the currently referenced package is malicious. The risk arises because a future malicious release, registry compromise, or package-maintainer account compromise could cause users following the documentation to execute unaudited code.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or its registry distribution channel.
2. A malicious release becomes the package version referenced by the latest tag.
3. A user follows the README and runs the documented npx command.
4. npx downloads and executes the mutable release.
5. The malicious package executes with the permissions of the user running the installation command.
6. It can access or modify resources available to that user, independent of the reviewed Skill code.

Impact Assessment

Successful exploitation could execute arbitrary code under the installing user's account. Potential scope includes project files, environment variables, user-accessible credentials, and other resources available to that account. Higher privileges would only be obtained if the command were separately run under a privileged account.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an audited, exact package version.
• Where supported, verify the downloaded package with a lockfile, integrity hash, signature, or trusted provenance record.
• Review and test new package releases before updating the documented version.
• Avoid running installation commands with administrative privileges.
• Consider documenting a non-executing download and verification workflow for security-sensitive environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends the user-provided news URL and Authorization header to a third-party server, but does not provide an explicit warning or informed consent about this data transfer. This becomes more dangerous in context because TLS verification is also disabled, increasing the risk of interception of both the API key and user-requested URLs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script explicitly disables TLS certificate verification with rejectUnauthorized: false, which allows a man-in-the-middle attacker to intercept or modify traffic to the remote API. Because this request carries both the user-supplied target URL and the API key, an attacker could steal credentials, observe requested content, or tamper with extraction results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README says parsing is cloud-based and uses an API key, but it does not clearly and explicitly disclose that user-supplied news URLs, and potentially fetched article content, are sent to a third-party server at easyalpha.duckdns.org. In a content-extraction skill, this matters because users may assume local processing and unknowingly transmit sensitive research targets, internal URLs, or copyrighted/private content to an external service.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub@latest install news-content-extractor, which pulls and executes the latest package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or changes unexpectedly, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares environment-variable requirements and describes executing a Node.js script, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens the trust boundary by making code execution and secret access less transparent to users and reviewers, increasing the chance that the skill can access sensitive values or perform actions beyond what is clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that it sends user-supplied URLs and an authentication token to a remote server, but it does not clearly warn users that their input and metadata will leave the local environment. This creates a real privacy and security risk because sensitive URLs, internal resources, or user-associated tokens may be transmitted to a third-party endpoint without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Comments and error messages are written in Chinese, and the script provides no option for users to select another language or indication that it is intentionally limited to a Chinese-speaking audience. This creates a natural-language policy issue because the skill implicitly enforces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The usage example and all user-facing instructions are presented only in English, and the example invocation assumes English phrasing for activation. If the skill requires English requests to trigger correctly, that would be a locale/language constraint that is not disclosed with opt-in or alternatives.

Content

No source excerpt is available for this finding.