ClawHub
Back to skill

Security audit

疯信子AI资讯

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a coherent AI news reporting workflow, but users should understand it can use GetNote credentials, upload generated reports, and run on a schedule if they enable cron.

Install only if you want generated reports sent to GetNote and are comfortable storing a GetNote API key locally. Review the setup script before running it, keep the .env file out of version control and logs, and add the cron job only if you want unattended daily network access and uploads.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documents shell execution (`bash .../generate.sh`), package installation, cron setup, and external network usage, but does not declare permissions or capabilities accordingly. This weakens user consent and platform policy enforcement because the skill can run commands and access external services without an explicit permission boundary.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a news collection/reporting tool, but the documented behavior also uploads generated content to an external note service, consumes API credentials, and persists execution logs locally. This mismatch is security-relevant because users may authorize the skill expecting local content generation only, while it actually performs outbound data transfer and persistence.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The feature description emphasizes report generation but does not clearly warn that generated content is automatically saved to an external note-taking service. This creates a consent and data-handling risk because collected or generated content may leave the local environment without the user understanding that upload is part of the workflow.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The documentation instructs users to store API credentials for GetNote but does not clearly explain that those credentials will be used for outbound requests to a third-party service. While credential configuration itself is normal, omitting the purpose and transmission context increases the chance of uninformed credential exposure or misuse.

Credential Access

High
Category
Privilege Escalation
Content
mkdir -p ~/.config/ai-news-generator

# 创建环境变量文件
cat > ~/.config/ai-news-generator/.env << 'EOF'
# Get笔记配置
GETNOTE_API_KEY="your_getnote_api_key"
GETNOTE_CLIENT_ID="your_getnote_client_id"
Confidence
80% confidence
Finding
The skill explicitly instructs storage of API credentials in a local `.env` file, which is credential handling and therefore security-sensitive. Although this is a common pattern, it becomes risky if the script later exposes, logs, or improperly permissions that file; the skill context includes shell execution and external API usage, increasing the importance of secret hygiene.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 添加到crontab
crontab -e

# 每天8点执行
0 8 * * * /path/to/ai-news-generator/scripts/generate.sh >> /path/to/logs/ai-news.log 2>&1
Confidence
89% confidence
Finding
The cron example establishes persistent scheduled execution, causing the skill to run automatically and repeatedly without per-run user approval. In a skill that performs network searches, accesses credentials, writes logs, and uploads content externally, persistence materially increases the blast radius of misconfiguration or abuse.

Static analysis

No suspicious patterns detected.