ClawHub
Back to skill

Security audit

Cn News Brief

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Chinese news briefing skill with disclosure and hardening issues, but no evidence of hidden persistence, credential access, destructive behavior, or data theft.

Installing this skill is reasonable if you want a Chinese hot-news briefing, but expect it to contact Baidu, Weibo, and Zhihu rather than all sources named in the README. Treat the output as fetched headlines, not true AI summaries, and be aware that remote headline text is not sanitized before terminal display.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/news_brief.py:77
Finding

Unsanitized Remote Content Allows Terminal Output Injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises network-backed functionality through external news sources and commands that run a script, but it declares no explicit tool scope or permissions. This creates a mismatch between documented behavior and declared capabilities, which can lead to over-broad execution in hosts that infer capabilities or to insufficient review of outbound data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill name, description, usage context, and output examples are presented exclusively in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as a justified region-specific tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states '多源聚合 + 分类 + AI摘要', implying an AI-based summarization capability. However, the implementation only fetches hot-list items from Baidu, Weibo, and Zhihu, applies keyword-based classification and sentiment tagging, and outputs raw titles; there is no model call or summarization logic anywhere in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code presents the skill as a Chinese-only news briefing and uses Chinese-only user-facing strings throughout, which constitutes a language/locale restriction in natural language. The file does not offer any user choice of language or document a justified region-specific compliance need.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/news_brief.py (reported line 125)May include surrounding context.

python
items = []
    try:
        req = urllib.request.Request(
            "https://api.zhihu.com/topstory/hot-lists/total?limit=20",
            headers={"User-Agent": "Mozilla/5.0"}
        )
        resp = _urlopen(req)

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill is presented as a Chinese news briefing tool that aggregates and summarizes news, but the tail of the document advertises an external AI brand-search optimization product and links to a marketing landing page. Promotional outbound links are not justified by the stated purpose of delivering news summaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.