ClawHub
Back to skill

Security audit

AI Daily Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it can post externally, use an authenticated browser session for X/Twitter collection, and run host-level installers without enough scoping or confirmation.

Review this skill before installing. Use a dry run first, confirm the Feishu destination, use low-scope Product Hunt and Feishu credentials, and avoid enabling GUI/opencli/X collection unless it runs against an isolated browser profile. Do not run setup.py with elevated privileges unless you accept system package and global npm installation attempts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""从 X/Twitter timeline 采集（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/home"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
88% confidence
Finding
The skill invokes a local browser automation tool against a CDP endpoint derived from environment state, enabling access to a user's browser context, cookies, and authenticated session data. In a news-briefing skill, using browser automation to access X is broader than necessary and increases the attack surface if the endpoint is redirected to a sensitive or remote browser instance.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""从 X/Twitter search 采集 Agent 相关内容（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/search?q=agent+framework+AI"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
88% confidence
Finding
This subprocess launches browser automation for X search using an environment-controlled CDP endpoint, which can expose authenticated browsing context and fetch data from a user-controlled browser session. That is unnecessarily powerful for a briefing collector and creates risk of unintended local capability use or session abuse.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd += ["--proxy", get_proxy()]
    cmd += [url]
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=max_time + 5)
        if not r.stdout.strip():
            return None
        return json.loads(r.stdout)
Confidence
84% confidence
Finding
The code executes `curl` with a URL and proxy value that may come from external configuration or upstream data, causing server-side request forgery behavior or unintended network access. Although `shell=True` is not used, this helper can still be abused to fetch internal endpoints, cloud metadata, or attacker-chosen hosts if untrusted input reaches `url` or proxy settings.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd += ["--proxy", get_proxy()]
    cmd += [url]
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=max_time + 5)
        return r.stdout
    except subprocess.TimeoutExpired:
        return None
Confidence
84% confidence
Finding
This helper fetches arbitrary text via `curl` using externally influenced URL and proxy inputs, enabling SSRF-style access to internal or sensitive network resources. In a news aggregation skill that collects from multiple sources, the attack surface is larger because upstream content or configuration may influence which URLs are requested.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""尝试自动安装工具，返回是否成功。"""
    print(f"   尝试自动安装 {name}...")
    try:
        subprocess.run(install_cmd, shell=True, check=True, capture_output=True)
        if check_cmd and not shutil.which(check_cmd):
            return False
        return True
Confidence
96% confidence
Finding
The setup helper executes installation commands via the shell using a string argument. Although the current call sites use hardcoded command strings, `shell=True` unnecessarily expands the attack surface through shell parsing, PATH hijacking, and future misuse if any part of the command becomes user- or environment-controlled. In a setup script for a briefing skill, automatic privileged package installation is especially risky because users may run it with elevated privileges.

Tainted flow: 'cdp' from os.environ.get (line 373, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""从 X/Twitter timeline 采集（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/home"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
90% confidence
Finding
Environment-controlled CDP configuration is passed into a browser automation subprocess, allowing runtime selection of the browser target. If an attacker can influence the environment or deployment config, the skill could be pointed at an unintended browser instance and exfiltrate data from that browsing context.

Tainted flow: 'cdp' from os.environ.get (line 373, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""从 X/Twitter search 采集 Agent 相关内容（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/search?q=agent+framework+AI"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
90% confidence
Finding
The environment-derived CDP endpoint controls where browser automation connects for X search collection. In practice, this means deployment configuration can redirect the collector to a browser containing unrelated authenticated state, making this more dangerous than normal HTTP scraping.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill requires environment variables, local file I/O, network access, and shell execution, but does not declare an explicit permissions model for those capabilities. This creates a transparency and governance gap: users and the platform may underestimate what the skill can access or do, including transmitting data externally and writing persistent local state.

Description-Behavior Mismatch

Low
Confidence
83% confidence
Finding
The skill description focuses on collecting and sending a daily briefing, but the instructions also state that collection logs are persisted to a local memory directory. This is additional data retention beyond the primary user-visible action, and if the logs contain fetched content, metadata, or failure details, they may unnecessarily retain sensitive or proprietary information.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill description presents a daily AI briefing aggregator, but the implementation silently expands scope to browser-automated collection from X/Twitter. Hidden data-source expansion matters because browser scraping can access session-bound content and user context that users would not reasonably expect from the declared functionality.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Using local browser/CDP automation is a powerful capability that is not clearly necessary for generating a daily AI news briefing and can interact with a user's authenticated browser state. In this skill context, that mismatch makes the behavior more dangerous because it grants access beyond ordinary feed fetching.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill's setup script attempts to install system packages and global tools (`apt`, `yum`, `brew`, `npm -g`) on the host. That exceeds the minimally justified capability for an AI daily briefing skill and creates supply-chain, privilege, and host-integrity risks if the script is run in a sensitive environment.

Description-Behavior Mismatch

Medium
Confidence
78% confidence
Finding
A script presented as verification/deduplication also performs aggregation and external message delivery, mixing low-risk local validation with side-effectful outbound actions. In an agent-skill context this increases the chance that a caller invokes a seemingly safe utility and unintentionally sends content to an external chat, causing data disclosure or unauthorized actions.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The skill invokes an external messaging CLI to transmit aggregated content to Feishu, creating a real outbound data-flow boundary. In an agent environment, sending externally is security-relevant because collected content may include sensitive or unreviewed text and the side effect is immediate.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger terms are broad enough to match common AI-related conversation, which can cause the skill to activate in contexts where the user did not intend data collection or message sending. Because the skill performs network collection and posts to an external Feishu chat, overbroad invocation increases the risk of unintended external actions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is designed to send collected content to a Feishu group chat, but the documentation does not require an explicit user warning or confirmation before external transmission. This is dangerous because users may not realize that generated or aggregated content will be posted to a group destination, creating privacy, confidentiality, or reputational risk if the content is unexpected or wrong.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The script sends externally aggregated content without an execution-point disclosure or confirmation, which is risky in a skill that may process third-party or user-derived data. In this context, silent outbound messaging can leak content to a Feishu chat or user unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
print("   检查 Product Hunt API...")
    ph_token = os.environ.get("PH_API_TOKEN", "")
    ok_ph, text = curl_check(
        "https://api.producthunt.com/v2/api/graphql",
        timeout=10,
        extra_headers={
            "Authorization": f"Bearer {ph_token}",
Confidence
84% confidence
Finding
This code prepares an authenticated request to an external Product Hunt endpoint using a bearer token from the environment. Even though the first GET result is not later used, transmitting credentials to third-party services is a real sensitive-data flow and increases exposure if the endpoint, proxy, or surrounding environment is untrusted.

External Transmission

Medium
Category
Data Exfiltration
Content
try:
        r = subprocess.run([
            "curl", "-s", "--max-time", "10", "-X", "POST",
            "https://api.producthunt.com/v2/api/graphql",
            "-H", f"Authorization: Bearer {ph_token}",
            "-H", "Content-Type: application/json",
            "-d", '{"query":"{ posts(first: 1) { edges { node { name } } } }"}'
Confidence
90% confidence
Finding
The POST request sends the Product Hunt bearer token to an external service, which is a genuine credential transmission. In the context of a preflight checker, this is expected functionality, but it still expands the attack surface through proxy interception, accidental debug logging, or execution in environments where outbound authenticated calls are not approved.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""从 X/Twitter timeline 采集（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/home"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
86% confidence
Finding
The browser automation command consumes untrusted remote HTML from X and operates through a powerful local browser-control channel, then parses and republishes that content without trust boundaries. In this context the danger is less classic command injection and more unsafe use of a high-privilege capability to ingest and propagate unvalidated external content.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""从 X/Twitter search 采集 Agent 相关内容（GUI 环境专用）。"""
    cdp = os.environ.get("OPENCLI_CDP_ENDPOINT", "http://127.0.0.1:9222")
    try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/search?q=agent+framework+AI"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
Confidence
86% confidence
Finding
This search collector uses the same high-privilege browser channel to fetch untrusted social-media content and then processes it with minimal validation. Because the skill's role is just briefing generation, the capability-to-purpose mismatch makes this significantly riskier than ordinary scraping.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""尝试自动安装工具，返回是否成功。"""
    print(f"   尝试自动安装 {name}...")
    try:
        subprocess.run(install_cmd, shell=True, check=True, capture_output=True)
        if check_cmd and not shutil.which(check_cmd):
            return False
        return True
Confidence
95% confidence
Finding
The dangerous part is not output handling but the shell-based process launch with a free-form command string. In setup contexts, this can enable command execution beyond intended installer actions if command sources change, shell metacharacters are introduced, or the environment is manipulated; the result can be arbitrary host modification or code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
print("Error: FEISHU_APP_ID or FEISHU_CHAT_ID not set")
                exit(1)

            result = subprocess.run(
                ["lark-cli", "--profile", feishu_app_id, "--as", "bot",
                 "im", "+messages-send",
                 "--chat-id", feishu_chat_id,
Confidence
72% confidence
Finding
The card content is built directly from untrusted item titles, URLs, descriptions, and metrics, then passed to an external messaging tool without sanitization. While this is not shell injection, it is an output-injection risk against the downstream consumer: crafted content could produce misleading links, abuse markdown/card rendering, mention users, or break message structure depending on Feishu/lark-cli parsing behavior.

Unvalidated Output Injection

High
Category
Output Handling
Content
# 发送失败,私信用户
                print(f"Card send failed: {result.stderr}")
                if feishu_open_id:
                    subprocess.run(
                        ["lark-cli", "--profile", feishu_app_id, "--as", "bot",
                         "im", "+messages-send",
                         "--user-id", feishu_open_id,
Confidence
74% confidence
Finding
The failure-notification path embeds result.stderr directly into a JSON string passed to lark-cli. If stderr contains quotes, braces, or control characters, it can corrupt the JSON payload or inject unintended message content into the outbound notification.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"""尝试自动安装工具，返回是否成功。"""
    print(f"   尝试自动安装 {name}...")
    try:
        subprocess.run(install_cmd, shell=True, check=True, capture_output=True)
        if check_cmd and not shutil.which(check_cmd):
            return False
        return True
Confidence
97% confidence
Finding
This is a genuine tool-parameter abuse issue because the helper accepts a command string and passes it directly to a shell. Even though current parameters are constant, the API shape is unsafe and normalizes a pattern that can later become exploitable through modified inputs, environment influence, or maintenance changes; on a setup script, the blast radius includes package installation and system changes.

Static analysis

No suspicious patterns detected.