ClawHub
Back to skill

Security audit

opennews

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenNews API helper, but it requests unnecessary local file-read access and documents token-in-URL WebSocket authentication, so users should review it before installing.

Install only if you are comfortable granting this skill access to run curl commands against the OpenNews/6551 API with your OPENNEWS_TOKEN. Treat the token as sensitive, avoid printing or saving WebSocket URLs that include it, and prefer a version that removes the unused local read permission or limits file access to explicit user-selected paths.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:153
Finding

Bearer Token Exposed Through WebSocket Query String

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 153–159
Vulnerability Type: Bearer credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code:

text
## WebSocket news_wss Protocol

Connect with the token in the query string:

```text
wss://ai.6551.io/open/news_wss?token=$OPENNEWS_TOKEN
text

### Technical Analysis

The Skill directs the agent to place the reusable `OPENNEWS_TOKEN` in the WebSocket URL query string. WSS protects the connection while data is in transit, but it does not prevent the URL from being recorded by client diagnostics, proxy logs, access logs, monitoring systems, shell history, exception reports, or debugging output.

Query parameters are less appropriate for bearer credentials than authorization headers because URLs routinely pass through logging and observability systems. The behavior is necessary only if the remote WebSocket API exclusively supports query-string authentication; transmitting the long-lived token in this form is not otherwise the minimum-risk method required for the declared news-streaming functionality.

### Attack Path

1. The agent expands `$OPENNEWS_TOKEN` while constructing the WebSocket URL.
2. A client, proxy, monitoring service, diagnostic facility, or execution log records the full URL.
3. An attacker with access to that record extracts the `token` query parameter.
4. The attacker replays the bearer token against the OpenNews authenticated endpoints or WebSocket service.
5. Until the token expires or is revoked, the attacker can exercise the permissions and quota associated with the affected account.

### Impact Assessment

Successful exploitation could allow unauthorized access to authenticated OpenNews functions, consumption of the victim's API quota, retrieval of account-specific strategy configuration or strategy-triggered events, and subscription to authenticated news streams. The obtained privilege is limi
...[truncated 128 chars]
Remediation
View remediation

Remediation Suggestions

  1. Modify the WebSocket service and examples to authenticate the handshake with an Authorization: Bearer header where client support permits it.
  2. If header authentication is unavailable, exchange the bearer token through an authenticated HTTPS request for a short-lived, single-use WebSocket ticket.
  3. Ensure WebSocket tickets have a narrow scope, brief expiration period, and replay protection.
  4. Explicitly prohibit printing or logging token-bearing URLs.
  5. Configure clients, reverse proxies, telemetry platforms, and error-reporting systems to redact the token query parameter.
  6. Document immediate token revocation and rotation procedures for suspected exposure.
  7. Avoid placing the expanded URL in shell history or diagnostic output.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
package.json:9
Finding

Unnecessary Broad Local File-Read Capability

Content
View full analysis

Vulnerability Details

File Location: package.json, lines 9–13
Vulnerability Type: Excessive tool permission violating least privilege
Risk Level: Low

Vulnerable Code:

json
"skills": {
  "dependencies": {
    "tools": ["exec", "read"],
    "binaries": ["curl", "jq"],
    "envVars": ["OPENNEWS_TOKEN"]
  }
}

Technical Analysis

The package requests the general read tool even though the documented workflows only need to invoke curl and optionally jq to query the remote financial-news API. No audited workflow requires reading local files.

Granting a broadly scoped file-read capability exceeds the minimum privileges needed for the declared functionality. Although the reviewed Skill contains no instruction that actively reads or exfiltrates local files, the unnecessary capability increases the consequences of malicious user input, prompt injection in remote content, or future unsafe changes to the Skill.

Attack Path

  1. The Skill is installed or invoked with the declared general read capability.
  2. The agent processes attacker-controlled input or untrusted content returned by a news source.
  3. That content induces the agent to use read on an unrelated local file accessible to the runtime.
  4. File contents are exposed in the active session.
  5. The contents may subsequently be disclosed in a response or included in a remote API request if the agent follows additional malicious instructions.

This is a privilege-enabling path rather than evidence of active exfiltration: no such malicious instruction or file-read operation was found in the audited project.

Impact Assessment

The capability could expose workspace files, configuration data, source code, or other runtime-readable information unrelated to financial-news retrieval. The actual scope depends on sandbox and filesystem restrictions imposed by the host. It does not independently provide file modification, persis ...[truncated 47 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove read from the declared tools array because the current Skill documentation does not require local file access.
  2. If a future workflow genuinely needs file input, request access only when that workflow is invoked.
  3. Restrict file access to explicit user-selected paths or a dedicated sandbox directory.
  4. Deny access to environment files, credential stores, SSH material, system configuration, and files outside the relevant workspace.
  5. Treat all remote news content and API responses as untrusted data and prevent them from authorizing tool calls.
  6. Add a permission review whenever new workflows or tools are introduced.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Fetch the full engine tree with all 6 categories and 85+ sources.

bash
curl -s -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  "https://ai.6551.io/open/news_type"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

Use a name only for discovery. An ambiguous_entity response is expected when multiple markets or issuers match.

bash
curl -s -X POST "https://ai.6551.io/open/finance-enhance/company-search" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"Hynix","identifier_type":"company_name","market":"GLOBAL","result_scope":"issuer","limit":20,"auto_collect":false}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

High-Impact News (score >= 80)

bash
curl -s -X POST "https://ai.6551.io/open/news_search" \
  -H "Authorization: Bearer $OPENNEWS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"score": 80, "limit": 50, "page": 1}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Line L126 directs the skill to perform query handling 'supporting both Chinese and English' as a requirement rather than a user-selectable option. This can conflict with language/locale policy expectations when a skill imposes language behavior without explicit opt-in or preference selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.