ClawHub
Back to skill

Security audit

财联社自定义新闻日报

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it can automatically install a browser tool and can activate on very broad search requests, so it should be reviewed before use.

Install only if you are comfortable with the skill using browser automation against 财联社 and with provisioning `agent-browser`. Prefer installing the browser tool yourself from a trusted, pinned source before enabling the skill, and narrow the activation phrases or require confirmation for generic searches and scheduled runs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:45
Finding

Automatic Installation of an Unpinned Third-Party Browser Dependency

Content
View full analysis

Vulnerability Details

File Location: skill.md:45-53
Additional Locations: skill.md:25-31, skill.md:204-205, README.md:8-13
Vulnerability Type: Unpinned and automatically installed third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

javascript
runCommand("clawhub install agent-browser");

The same unpinned installation command is presented to users in README.md:

bash
clawhub install agent-browser

Technical Analysis

The workflow instructs the Agent to automatically install agent-browser from ClawHub when the browser tool is unavailable. The dependency is identified only by a mutable package name. No exact version, immutable digest, checksum, trusted publisher identity, signature verification, or package provenance check is specified.

Consequently, the code reviewed in this project does not fully determine the code that will be installed and used at runtime. A compromised registry account, malicious replacement package, dependency-confusion condition, or unsafe future package release could cause the installation command to retrieve attacker-controlled components.

The Skill metadata declares browser as its allowed tool, but the dependency bootstrap workflow also relies on command execution through runCommand. This expands the effective capability required by the Skill beyond its declared browser-only operation.

Attack Path

  1. A user requests a supported news-search operation.
  2. The Skill checks whether the browser capability is available.
  3. If it is unavailable, the Skill invokes clawhub install agent-browser without requesting explicit approval and without selecting an immutable package version.
  4. ClawHub resolves the current package associated with the agent-browser name.
  5. An attacker who has compromised the package, publisher account, registry resolution process, or a future release supplies malicious package content.
  6. Pa ...[truncated 965 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from the Skill workflow and require an administrator to provision the browser tool before the Skill is enabled.
  2. If automated installation is necessary, require explicit user or administrator confirmation before invoking the package manager.
  3. Pin agent-browser to a reviewed exact version or, preferably, an immutable artifact digest.
  4. Verify package signatures, checksums, publisher identity, and registry origin before installation.
  5. Maintain an allowlist of approved package identities and versions, and reject packages that do not match it.
  6. Run installation and browser execution in a restricted sandbox with minimal filesystem access, no unnecessary credentials, limited outbound networking, and no administrative privileges.
  7. Declare command execution as an explicit required capability if the installation workflow is retained, rather than presenting the Skill as browser-only.
  8. Record the resolved version and integrity digest in audit logs to support incident investigation and reproducible deployment.
  9. Update both skill.md and README.md so that documentation consistently directs users to the pinned, verified dependency.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase "搜索[关键词]" is overly generic and can collide with ordinary user requests unrelated to this skill, causing unintended activation. Because the skill performs browser-driven automation and external web access, accidental invocation could lead to unrequested navigation, data retrieval, or workflow execution beyond the user's actual intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The activation conditions for '获取财联社新闻' and '执行财联社新闻自动化任务' are ambiguous because they do not clearly constrain whether the user wants this exact skill, a different news source, or a one-off lookup versus scheduled automation. In context, this is less severe than direct code execution, but it still increases the risk of unintended invocation and unnecessary browsing activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases 获取[关键词]新闻 and especially 搜索[关键词] are broad enough to match many ordinary user requests unrelated to this specific source or workflow. Overbroad activation can cause the wrong skill to fire unexpectedly, leading the agent to browse external sites or follow this skill's automation path when the user did not intend to invoke it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation instructs the agent to run a shell command to install a tool at runtime, even though the skill's core purpose is only to fetch and summarize news. Allowing command execution expands the trust boundary from browser-only automation to local environment modification, which can be abused for unauthorized package installation, supply-chain risk, or execution of unintended commands if the installation path or package source is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow repeats runtime dependency installation and adds sleep, normalizing command execution as part of ordinary skill use. This makes the issue more dangerous because it operationalizes the behavior in the main execution path, increasing the chance an agent will attempt host-level changes during a simple news task.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The instruction to "use the previous keyword" relies on ambiguous conversational state, which can cause the skill to act on stale or unintended prior input. In an automated or scheduled context, this increases the risk of fetching the wrong topic and producing misleading output without clear user authorization for the reused parameter.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.