Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates a Conan weekly report from public web searches, saves it locally, and only sends it externally when a webhook URL is configured.
Before installing, review whether you want weekly scheduled runs, local markdown files under the skill's reports directory, and optional webhook delivery. Do not set REPORT_WEBHOOK_URL unless you trust the destination, and prefer an HTTPS endpoint because the code does not enforce one.
The declared purpose is weekly information collection, but the skill also reportedly writes local report files and sends reports to an external webhook URL that are not disclosed in the primary description. This mismatch is dangerous because hidden persistence and outbound transmission can exfiltrate collected data or create unintended side effects without informed user approval.
The lockfile includes undici 7.22.0 with multiple published advisories affecting HTTP parsing and connection handling, including request/response smuggling and CRLF injection. Although undici is only a transitive devDependency through clawhub rather than the skill's declared runtime HTTP client, these classes of bugs can still be serious if the development tool makes outbound HTTP requests to untrusted or attacker-influenced endpoints.
The skill documentation omits any explicit tool scope or permissions while the implementation reportedly uses environment data. Undeclared capability use weakens user consent and reviewability because operators cannot tell from the manifest what resources the skill may access at runtime.
The skill lists a bare manual trigger of "柯南周报" without clarifying where it is valid, how exact matching works, or any exclusion conditions. In a markdown skill description, this kind of short natural-language trigger can be invoked unintentionally when users mention the phrase conversationally rather than intending to run the skill.
The documentation mentions webhook pushing and local file saving without a clear user-facing warning about data effects, which undermines informed consent. Users may trigger the skill expecting simple content retrieval while it persists outputs locally and transmits them externally.
Webhook push is not necessary for a Conan weekly information collection skill unless clearly justified and user-enabled. An unnecessary outbound channel increases the attack surface and can be repurposed for unauthorized data export or silent forwarding of generated content.
The changelog reveals webhook pushing and local file saving capabilities beyond the stated reporting/search scope, indicating the documentation is incomplete or inconsistent. Security reviewers and users may rely on the top-level description and miss side effects that persist or transmit data.
The skill’s stated purpose is to collect and format a weekly report, but it also contains undisclosed outbound transmission logic via a webhook. Even if optional, this creates a data exfiltration/distribution path to an arbitrary external endpoint, which expands the skill’s capabilities beyond local report generation and can leak generated content or operational metadata without clear user awareness.
Reading REPORT_WEBHOOK_URL from the environment and posting the full report to any supplied URL gives the skill arbitrary outbound delivery capability. In a scheduled automation context, this is more dangerous because it can silently and repeatedly send content to attacker-controlled infrastructure if the environment is misconfigured or manipulated.
文档在定时任务示例中直接指定 --tz "Asia/Shanghai"，并在注意事项中将其作为默认设置引用，整体呈现为预设地区/时区而非用户可选项。按规则，未提供语言/locale 选择或明确说明其仅适用于特定地区时，属于自然语言层面的 locale 策略风险。
The lockfile pins fflate to 0.8.2, which is flagged with a known advisory for an infinite loop when parsing malformed ZIP64 archives. In this skill, fflate appears only as a transitive devDependency of clawhub, so the issue is real in the dependency tree but likely only reachable during development or packaging workflows, making exploitation impact limited to denial of service in those contexts.
The package description is entirely in Chinese and presents the skill as a Chinese-language experience, but the file provides no indication that users can opt into another language or that the locale restriction is justified. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
Using a caret version for node-fetch allows newer minor/patch releases to be installed automatically, which can introduce unexpected behavior or a compromised upstream package into the dependency chain. In a skill that fetches live web content, dependency trust is part of the attack surface, so supply-chain drift is a real security concern even if the package itself is common.
"test": "node index.js"
},
"dependencies": {
"node-fetch": "^2.7.0"
},
"devDependencies": {
"clawhub": "^0.7.0"
The devDependency clawhub is also specified with a caret range, allowing unreviewed updates during development or CI runs. While devDependencies are usually less exposed in production, they still present supply-chain risk because compromised tooling can affect builds, tests, or published artifacts.
"node-fetch": "^2.7.0"
},
"devDependencies": {
"clawhub": "^0.7.0"
}
}
This markdown file is entirely written in Chinese and does not indicate that the language is optional, user-selected, or required for a region-specific purpose. The policy requires flagging language or locale constraints when they force a specific language without user opt-in or clear justification.
This markdown report is entirely written in Chinese, and it does not indicate that the skill is region-specific or that users can opt into a preferred language. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.