ClawHub
Back to skill

Security audit

Site Feeds

Security checks for vulnerabilities and agentic risk

Overview

The skill is for website feed fetching, but it also directs agents to install mutable third-party tooling, run a local Docker service, and store credentials with limited safeguards.

Review before installing. Use this only if you are comfortable running RSSHub locally, installing airsstool from external instructions, and maintaining persistent feed subscriptions. Prefer pinned releases, a dedicated nonprivileged environment, explicit confirmation for Docker and deletion actions, and secure handling of any API keys, cookies, or tokens instead of casually placing them in .env.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Installation from a Mutable Third-Party Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-34
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown
### 2. Install airsstool

Follow the instructions at [https://github.com/heqi201255/airsstool](https://github.com/heqi201255/airsstool)

Technical Analysis

The Skill directs the Agent to follow installation instructions hosted in a mutable external GitHub repository. It does not specify an audited release, immutable commit, package version, cryptographic checksum, signature, or exact installation commands.

Consequently, the effective code and commands executed during installation can change after this Skill has been reviewed. Compromise of the repository owner, malicious modification of the upstream project, or unsafe changes to its installation documentation could result in arbitrary commands or dependencies being executed under the user's account.

The external dependency is relevant to the declared feed-fetching functionality, but obtaining its latest version without integrity controls exceeds a safely constrained installation process.

Attack Path

  1. An attacker compromises the referenced GitHub account or its repository, or introduces a malicious upstream change.
  2. The attacker modifies the installation instructions, package source, or dependency declarations.
  3. The Agent follows the mutable instructions as required by SKILL.md.
  4. Malicious commands or packages execute with the privileges of the Agent or user performing installation.
  5. The payload may access files, credentials, environment variables, network resources, or Docker facilities available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the installing user's security context. The accessible scope could include that user's files, subscription database, environment variables, network access, and any Docker permissi ...[truncated 315 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin airsstool to a reviewed release tag and immutable commit hash.
  • Provide exact, auditable installation commands instead of delegating to mutable external instructions.
  • Verify downloaded artifacts using a published cryptographic checksum or signature.
  • Pin transitive dependency versions through an appropriate lock file.
  • Install the tool in an isolated virtual environment or container under a nonprivileged account.
  • Review upstream changes before updating the pinned version.
  • Avoid granting the installer unnecessary access to Docker, sensitive environment variables, or privileged filesystem locations.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:258
Finding

Plaintext Handling of Site Credentials in an Environment File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-27 and line 258
Vulnerability Type: Insufficiently protected storage of sensitive configuration
Risk Level: Medium

Vulnerable Code

markdown
4. Create a `.env` file for environment variables
5. Modify `docker-compose.yml` to add Puppeteer support if needed, and add `env_file: - .env` to the rsshub service
6. Run `docker compose up -d`
markdown
- If some websites fail to fetch, use `airsstool check <website> <route>` to see if there's a `RequireConfig` note. If so, the website requires environment variables. Search online for how to obtain them and ask the user for help. Once obtained, add them to the `.env` file and restart the RSSHub service

Technical Analysis

The Skill instructs the Agent to obtain site-specific environment variables from the user and store them in a plaintext .env file. Such variables may include authentication tokens, cookies, API keys, or other credentials required by RSSHub routes.

The instructions do not require restrictive filesystem permissions, exclusion from source control, token scoping, log redaction, secure secret injection, rotation, or deletion after use. They also tell the Agent to search online for acquisition instructions without requiring authoritative documentation, increasing the chance that unsafe or misleading credential-handling guidance will be followed.

The flagged behavior does not explicitly transmit .env contents to an attacker-controlled service. Passing required credentials to RSSHub can be necessary for authenticated feeds and is aligned with the Skill's purpose. The confirmed issue is the insufficiently protected local storage and handling of those secrets, rather than demonstrated intentional exfiltration.

Attack Path

  1. A requested RSSHub route reports that additional configuration is required.
  2. The Agent asks the user to provide an API token, session cookie, or similar credential.
  3. Th ...[truncated 1061 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer Docker secrets or a supported operating-system secret manager instead of a plaintext .env file.
  • If .env must be used, create it with owner-only permissions such as mode 0600.
  • Store it outside source-controlled and publicly served directories.
  • Add .env to .gitignore before writing any secrets and verify it is not already tracked.
  • Request only narrowly scoped, read-only credentials needed for the selected feed.
  • Use authoritative platform and RSSHub documentation when explaining how credentials are obtained.
  • Never print, echo, or include credential values in command logs or Agent responses.
  • Restrict the RSSHub container and unrelated processes from accessing unnecessary host files or environment variables.
  • Document credential expiration, rotation, revocation, and secure removal procedures.
  • Obtain explicit user confirmation before storing account credentials persistently.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description is broad enough to match many generic requests about updates or website content, which can cause over-invocation of a skill with installation, persistence, and external-fetch capabilities. Overly permissive activation increases the chance that an agent will use this skill in contexts where a simpler, safer response would suffice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation guidance includes generic phrases like 'What's new on...' and monitoring requests without constraints, making it easy for the skill to trigger in broad browsing scenarios. Because the skill can also lead to deployment, persistence, and content retrieval from varied sources, ambiguous triggers raise the likelihood of unnecessary or risky activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's stated purpose is fetching website updates, but the documentation expands into local service deployment, environment setup, database initialization, and persistent subscription management. This broadens the operational scope significantly and could cause an agent to perform system administration or stateful changes that a user did not expect from a read-oriented content skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Instructions to deploy RSSHub with Docker, edit compose files, and administer a local service go beyond the minimum capability needed to fetch site updates. In an agent setting, this creates an unnecessary expansion of authority into host-level changes, service management, and potential exposure from pulling and running third-party containers.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The instructions direct the agent to create a persistent local folder and maintain deployment artifacts and environment files, establishing session-to-session state unrelated to ephemeral content fetching. Persistent state increases the risk of unnoticed configuration drift, residual sensitive data, and repeatable side effects from future invocations.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
Check if the user already has a running RSSHub Docker container. If not:

1. Inform the user that RSSHub needs to be locally deployed
2. After user confirmation, create a `rsshub` folder in a suitable location
3. Follow the 'Docker Compose Deployment' guide in [RSSHub deployment docs](https://docs.rsshub.app/deploy/) to download the `docker-compose.yml` in the `rsshub` folder
4. Create a `.env` file for environment variables
5. Modify `docker-compose.yml` to add Puppeteer support if needed, and add `env_file: - .env` to the rsshub service

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a fetch-oriented tool, but the skill also documents creation, modification, and deletion of persistent subscriptions. That mismatch can lead an agent to take durable actions on local state under the guise of a simple content retrieval request, increasing the risk of unintended changes or data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill exposes an --enable-nsfw option but does not require a user warning or confirmation before retrieving adult or otherwise sensitive content. In a broad website-content skill, omission of this safeguard can result in unexpected policy-sensitive output or accidental exposure to unsuitable material.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Guidance to search for required credentials and place them into a .env file introduces secret acquisition and storage behavior unrelated to simple feed retrieval. This can lead agents to solicit, handle, or persist sensitive tokens without clear boundaries, increasing the risk of credential exposure, misuse, or overcollection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.