ClawHub
Back to skill

Security audit

x-reader通用内容抓取

Security checks for vulnerabilities and agentic risk

Overview

This content-reader skill appears purpose-aligned, but users should be aware it may use saved login sessions and local Obsidian inbox commands.

Install only if you want an agent helper that can fetch external content, use browser or platform fallbacks, and interact with an Obsidian-configured inbox. Run login only for accounts you intend it to use, and treat clear as a potentially destructive inbox command until the implementation documents its exact scope.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description uses broad language such as 'use when you need to fetch full article content' and 'any web page,' which can cause the skill to be selected for a wide range of ordinary browsing or summarization requests. Overbroad invocation cues increase the chance that the agent routes unrelated user tasks into a skill that performs network access, session-backed fetching, and possible local inbox interactions without sufficiently specific intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation exposes inbox management commands and an Obsidian-vault-backed configuration path that are not clearly disclosed in the manifest description. This creates a capability mismatch: an agent or user may invoke what appears to be a simple reader skill without understanding that it can read from or modify locally stored note/inbox data, increasing the risk of unintended access to local files or silent side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documents login/session storage and external fetching behavior, including browser fallback and saved sessions, but does not clearly warn users that credentials or session artifacts may persist locally and that invoking the skill causes network requests to third-party services. In an agent setting, this can lead to silent use of authenticated sessions, privacy leakage, or user surprise about external data flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description lists WeChat, Bilibili, Twitter/X, YouTube, Xiaohongshu, RSS, and any web page, but the supported-platforms table also documents Telegram support. This is a semantic mismatch between the declared scope and the documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.