ClawHub
Back to skill

Security audit

AI Daily Briefing

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it advertises, but it needs Review because it can install global tools, use local browser/API credentials, and send generated content to Feishu with broad triggering and limited confirmation.

Install only if you are comfortable giving this skill Feishu bot-send authority, Product Hunt and optional Firecrawl/API credentials, proxy settings, local SQLite persistence, and possible access to a logged-in browser session for X/Twitter. Prefer dry-run first, avoid authenticated proxy URLs in PROXY_URL on shared machines, install lark-cli yourself from a pinned trusted version, and confirm the target FEISHU_CHAT_ID before allowing automatic sends.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/common.py:98
Finding

Proxy credentials exposed through process command-line arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.py:100
Finding

Unpinned package installation with global system scope

Content
View full analysis
Remediation
View remediation
"], check=True, capture_output=True, ) ``` 7. Avoid running setup as root. Document the minimum required installation permissions. 8. Periodically review the pinned package and transitive dependency set before updating. 9. Validate the installed executable's version and, where feasible, its integrity before using it for Feishu operations. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (71)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This second mismatch finding is also valid: the skill claims end-to-end news briefing generation and Feishu delivery, but parts of the behavior are delegated to local file aggregation, database maintenance, and external tooling rather than being transparently represented in the top-level contract. Hidden persistence and external side effects increase risk because they create stateful behavior and outbound communication beyond what a casual description suggests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This second mismatch finding is also valid: the skill claims end-to-end news briefing generation and Feishu delivery, but parts of the behavior are delegated to local file aggregation, database maintenance, and external tooling rather than being transparently represented in the top-level contract. Hidden persistence and external side effects increase risk because they create stateful behavior and outbound communication beyond what a casual description suggests.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/collect.py (reported line 28)May include surrounding context.

python
# ── 环境 ──
load_env()
DATE = os.environ.get("AI_DAILY_DATE", os.popen("date +%Y-%m-%d").read().strip())
DEFAULT_OUTPUT_DIR = f"/tmp/ai-daily-briefing/{DATE}"

# ── 板块配置 ──

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/collect.py (reported line 248)May include surrounding context.

python
def collect_github(max_items):
    """从 GitHub Search API 采集。"""
    week_ago = os.popen("date -d '7 days ago' +%Y-%m-%d").read().strip()
    data = curl_json(
        f"https://api.github.com/search/repositories?q=created:>{week_ago}+stars:>50+topic:ai"
        f"&sort=stars&order=desc&per_page=10"

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/collect.py (reported line 425)May include surrounding context.

python
def collect_github(max_items):
    """从 GitHub Search API 采集。"""
    week_ago = os.popen("date -d '7 days ago' +%Y-%m-%d").read().strip()
    data = curl_json(
        f"https://api.github.com/search/repositories?q=created:>{week_ago}+stars:>50+topic:ai"
        f"&sort=stars&order=desc&per_page=10"

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
94% confidence
Finding

Passing {**os.environ, "OPENCLI_CDP_ENDPOINT": cdp} leaks the full parent environment into a browser automation child process. In an agent runtime, that environment may include tokens, proxy credentials, and other secrets that the child tool or any connected browser/plugin could access, making this materially dangerous.

Content

Scanner excerpt · scripts/collect.py (reported line 349)May include surrounding context.

python
try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/home"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
        html = r.stdout
        if not html or len(html) < 1000:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
94% confidence
Finding

This second opencli invocation repeats the same full-environment forwarding pattern. Because the child process performs browser automation, exposing all environment variables significantly raises the risk of credential leakage and cross-capability abuse.

Content

Scanner excerpt · scripts/collect.py (reported line 377)May include surrounding context.

python
try:
        r = subprocess.run(
            ["opencli", "web", "fetch", "https://x.com/search?q=agent+framework+AI"],
            capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": cdp}
        )
        html = r.stdout
        if not html or len(html) < 1000:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 65)May include surrounding context.

python
def load_env():
    """从 ~/.openclaw/.env 加载环境变量。"""
    env_file = os.path.expanduser("~/.openclaw/.env")
    if not os.path.exists(env_file):
        return

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.py (reported line 124)May include surrounding context.

python
def load_env():
    """从 ~/.openclaw/.env 加载环境变量。"""
    env_file = os.path.expanduser("~/.openclaw/.env")
    if not os.path.exists(env_file):
        return

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 66)May include surrounding context.

python
def load_env():
    """从 ~/.openclaw/.env 加载环境变量。"""
    env_file = os.path.expanduser("~/.openclaw/.env")
    if not os.path.exists(env_file):
        return

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/preflight_check.py (reported line 106)May include surrounding context.

python
if shutil.which("opencli"):
            out = subprocess.run(
                ["opencli", "doctor"],
                capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": "http://127.0.0.1:9222"}
            ).stdout
            if "Extension: connected" in out:
                _ok("opencli 扩展已连接")

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/preflight_check.py (reported line 123)May include surrounding context.

python
if shutil.which("opencli"):
            out = subprocess.run(
                ["opencli", "doctor"],
                capture_output=True, text=True, env={**os.environ, "OPENCLI_CDP_ENDPOINT": "http://127.0.0.1:9222"}
            ).stdout
            if "Extension: connected" in out:
                _ok("opencli 扩展已连接")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Using shell=True for install_cmd is a classic tool-parameter abuse pattern because it delegates command parsing to the shell and allows broad execution semantics. In a setup script that may be run with elevated privileges and invokes package managers/npm, this materially increases the blast radius of any future input contamination, environment manipulation, or code reuse mistake.

Content

Scanner excerpt · scripts/setup.py (reported line 30)May include surrounding context.

python
"""尝试自动安装工具，返回是否成功。"""
    print(f"   尝试自动安装 {name}...")
    try:
        subprocess.run(install_cmd, shell=True, check=True, capture_output=True)
        if check_cmd and not shutil.which(check_cmd):
            return False
        return True

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script can send aggregated content to Feishu automatically using environment-provided identifiers, without an explicit user-facing warning in this execution path. Because the content comes from multiple external sources and may include unreviewed titles, descriptions, and URLs, this creates a real exfiltration/transmission risk to an external service.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

The code injects untrusted stderr from an external subprocess directly into a Feishu outbound message. If the CLI or upstream service returns attacker-influenced content, the script can relay misleading text, sensitive diagnostics, internal identifiers, or formatting payloads to a user, creating an output-injection and information-disclosure issue.

Content

Scanner excerpt · scripts/verify.py (reported line 499)May include surrounding context.

python
# 发送失败,私信用户
                print(f"Card send failed: {result.stderr}")
                if feishu_open_id:
                    subprocess.run(
                        ["lark-cli", "--profile", feishu_app_id, "--as", "bot",
                         "im", "+messages-send",
                         "--user-id", feishu_open_id,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill requests and describes capabilities equivalent to environment access, filesystem read/write, network access, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability: an agent may execute broader actions than users or platform controls expect, including sending messages, accessing secrets, and writing persistent state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough to activate on common requests about AI news, daily briefings, or AI updates. Overbroad triggering is risky because it can cause the agent to invoke a capability-heavy skill unexpectedly, leading to network collection, filesystem writes, or external message sending when the user only intended a simple conversational answer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill description and operational instructions are written to generate the briefing in Chinese-oriented formatting and messaging, including '生成每日 AI 资讯简报' and '中英文自动加空格', with no indication that users may choose another language or locale. This creates a locale/language policy concern because the skill appears to impose a specific language behavior without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing natural-language documentation and CLI help context in Chinese only, such as the module docstring describing usage and environment variables. That imposes a specific language on users without opt-in or an alternative locale, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/collect.py (reported line 111)May include surrounding context.

python
if fc_key:
        try:
            import json as _json
            r = subprocess.run(
                [
                    "curl", "-s", "--max-time", "20",
                    "-X", "POST", "https://api.firecrawl.dev/v1/scrape",

Tainted flow: 'fc_key' from os.environ.get (line 107, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/collect.py (reported line 111)May include surrounding context.

python
if fc_key:
        try:
            import json as _json
            r = subprocess.run(
                [
                    "curl", "-s", "--max-time", "20",
                    "-X", "POST", "https://api.firecrawl.dev/v1/scrape",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/collect.py (reported line 114)May include surrounding context.

python
r = subprocess.run(
                [
                    "curl", "-s", "--max-time", "20",
                    "-X", "POST", "https://api.firecrawl.dev/v1/scrape",
                    "-H", "Content-Type: application/json",
                    "-H", f"Authorization: Bearer {fc_key}",
                    "-d", _json.dumps({"url": "https://www.anthropic.com/news", "formats": ["markdown"]})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/collect.py (reported line 278)May include surrounding context.

python
try:
        query_json = json.dumps({"query": f"{{ {SECTIONS['producthunt']['query']} }}"})
        r = subprocess.run(
            ["curl", "-s", "--max-time", "15",
             "-X", "POST", "https://api.producthunt.com/v2/api/graphql",
             "-H", f"Authorization: Bearer {ph_token}",

Tainted flow: 'ph_token' from os.environ.get (line 272, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/collect.py (reported line 278)May include surrounding context.

python
try:
        query_json = json.dumps({"query": f"{{ {SECTIONS['producthunt']['query']} }}"})
        r = subprocess.run(
            ["curl", "-s", "--max-time", "15",
             "-X", "POST", "https://api.producthunt.com/v2/api/graphql",
             "-H", f"Authorization: Bearer {ph_token}",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a news briefing collector, but the implementation includes undeclared X/Twitter scraping through browser automation. This capability mismatch is dangerous in an agent skill because it hides materially more powerful behavior than users would reasonably expect, increasing the chance of over-collection or privacy-impacting browser access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.