ClawHub
Back to skill

Security audit

substack AI news SEARCH

Security checks for vulnerabilities and agentic risk

Overview

This skill uses disclosed browser automation to search Substack and has quality issues, but I found no hidden persistence, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable letting the agent open Substack pages through browser automation. Expect rough output: the helper may fail because of its subprocess invocation style, and even when it works it may return raw search-result text rather than a polished article digest.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The primary purpose broadly aligns with searching Substack via browser automation, but the declared description overstates the structure and formatting of the output. The code opens Substack search pages and scrapes visible link text, which is consistent with Substack search scraping. However, it does not explicitly extract titles, authors, and summaries as separate fields, nor does it produce a numbered digest. Instead, it gathers long link text blobs from browser snapshots, deduplicates them, and prints a JSON list. That is a material description-to-behavior mismatch in capability and output format, though not a wholly different purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes Python and browser automation to access the network and shell, but it declares no explicit tool scope or permissions. That creates an overprivileged and ambiguous execution model where an agent may grant broader capabilities than the skill actually needs, increasing the risk of misuse or unexpected command execution.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run(cmd: str, timeout: int = 20) -> str:
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=False)
    return r.stdout.strip()
Confidence
97% confidence
Finding
The helper passes a single string to subprocess.run with shell=False, which on typical Python runtimes attempts to execute a literal program name like "agent-browser open 'URL'" rather than safely tokenizing arguments. Because QUERY and DATE_RANGE are user-influenced and embedded into that string, a future change to shell=True or alternative wrappers could turn this into command-injection risk, and even as written it is an unsafe process-invocation pattern that can fail unpredictably or invoke the wrong executable path. In an agent skill context, launching external browser automation based on untrusted input increases the blast radius beyond simple parsing bugs.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest says the skill extracts titles, authors, and summaries and formats them as a numbered digest. In practice, the code snapshots link text, filters by length, deduplicates raw strings, and emits a JSON array of those strings, with no parsing of author names, summaries, or numbered digest formatting.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill is described as scraping AI-related articles from Substack search results, implying article-specific extraction. The code instead accepts any snapshot line beginning with '- link ' and only excludes short text, so it may capture non-article page links and does not verify that collected items are actual article results.

Static analysis

No suspicious patterns detected.