ClawHub
Back to skill

Security audit

AI News Sentiment

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, coherent finance news sentiment helper with no hidden execution, persistence, or data access found, though its unused unpinned dependencies should be cleaned up before installation.

Before installing, consider removing or pinning the declared third-party dependencies unless you need future live data collection features. Also confirm the Chinese-language documentation and output fit your intended users.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.json:7
Finding

Unpinned and Unnecessary Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: skill.json:7
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

json
"dependencies": ["akshare", "pandas", "requests"],

Technical Analysis

The skill declares three third-party packages without version constraints or integrity hashes. Dependency resolution may therefore select different package versions over time, making installations non-reproducible and exposing the installation process to compromised future releases or transitive dependencies.

None of these packages is imported or used by the current implementation in news_sentiment.py, which relies only on Python standard-library modules. The unnecessary dependencies consequently expand the supply-chain attack surface without supporting any current functionality.

The reviewed evidence does not establish that any listed package is currently malicious. The vulnerability is the unsafe and unnecessary dependency declaration.

Attack Path

  1. A user or deployment system installs the skill and processes skill.json.
  2. The installer resolves the unpinned dependency names from its configured package registry.
  3. A compromised future release, compromised transitive dependency, or package supplied through an untrusted registry is selected.
  4. Malicious package installation logic or imported runtime code executes in the installation environment.
  5. That code operates with the privileges granted to the installer or skill runtime.

Exploitation requires compromise or substitution of a declared or transitive dependency and an installation workflow that acts on this dependency list.

Impact Assessment

Successful supply-chain exploitation could permit arbitrary code execution with the privileges of the account or service installing or running the affected dependency. Depending on the deployment environment, this could expose accessible files, e ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove akshare, pandas, and requests from the manifest because the current implementation does not use them.
  2. If future functionality requires third-party packages, pin each dependency to an exact reviewed version.
  3. Use a lockfile or hash-verified installation mechanism to preserve package integrity and reproducibility.
  4. Retrieve packages only from an approved, authenticated registry.
  5. Review and pin transitive dependencies where the packaging workflow permits it.
  6. Integrate dependency vulnerability scanning and automated update review into the release process.
  7. Install and execute the skill under a least-privileged account in an isolated environment.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The entire skill documentation is written in Chinese and provides no indication that other languages are supported or that Chinese is a required, justified locale for use. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The module title, feature description, and function docstring are presented in Chinese only. This creates a language policy concern because the skill effectively requires Chinese comprehension without offering the user a language choice or documenting the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is written entirely in Chinese and indicates the skill is for news sentiment analysis without offering any language choice or noting that it is limited to Chinese-speaking users. This can violate language/locale policy expectations when a skill implicitly constrains interaction to a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.