CamelCamelCamel Alerts

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent price-alert purpose, but its setup uses persistent scheduled shell commands with unsafe URL handling that deserves review before installation.

Review before installing. Use only your own CamelCamelCamel HTTPS alert URL, avoid pasting untrusted feed strings into the cron command, and prefer a safer setup that validates the host and stores state in a private per-user directory rather than /tmp. Expect this skill to create a recurring job and local cache; the included notification script may need additional integration to actually send Telegram messages.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/fetch_rss.py:27

Finding

Unrestricted URL Fetching Enables SSRF and Local Resource Access

Content

View full analysis

[cache_dir]") sys.exit(1) feed_url = sys.argv[1] cache_dir = sys.argv[2] if len(sys.argv) > 2 else "/tmp/camelcamelcamel" cache_file = os.path.join(cache_dir, "cache.json") # Fetch feed xml_content = fetch_rss(feed_url) ``` ### Technical Analysis The script passes an untrusted command-line value directly to `urllib.request.urlopen()` without validating the URL scheme, hostname, port, credentials, resolved address, or redirect destination. Although the skill is intended exclusively for CamelCamelCamel HTTPS feeds, the implementation does not enforce that restriction. An attacker who can influence the command-line argument can cause the process to request internal HTTP services. Depending on the URL handlers available in the runtime, a `file://` URL may also read a local file accessible to the process. Retrieved content is parsed as XML, and values from `title`, `link`, `description`, and `pubDate` elements can subsequently be emitted in JSON. Consequently, XML-formatted internal responses or local files may be partially disclosed through standard output. ### Attack Path 1. The attacker gains control over, or convinces a user to configure, the feed URL argument. 2. The attacker supplies an internal URL such as an address on a loopback, private, or link-local networ ...[truncated 966 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/SETUP.md:31

Finding

Unquoted Feed URL in Documented Cron Command Enables Shell Command Injection

Content

View full analysis

/tmp/camelcamelcamel | jq '.alerts' | /home/goliso/clawd/skills/camelcamelcamel-alerts/scripts/notify.sh" }' ``` The guide then instructs the user: ```text Replace `` with your actual feed URL. ``` ### Technical Analysis The setup guide places the feed URL placeholder unquoted inside a command string that is expected to be interpreted by a shell. If the replacement value contains shell metacharacters such as `;`, `|`, `&&`, command substitution, or redirection operators, the shell will interpret those characters as syntax rather than as part of a single URL argument. The outer single quotes protect the JSON only while the setup command is initially entered. They do not ensure that the eventual `command` field is executed without shell interpretation. The documented use of pipelines confirms that the command must be interpreted by a shell or equivalent command processor. This issue requires a malicious or otherwise attacker-controlled feed value to be inserted into the cron configuration. ### Attack Path 1. An attacker provides a purported CamelCamelCamel feed value containing shell syntax. 2. A user follows the documentation and replaces the unquoted `` placeholder with that value. 3. The cron configuration stores the resulting command string. 4. At the next scheduled run, a shell interprets the pipeline and the injected metacharacters. 5. The injected command executes with the privileges of the account that owns the cron job. For example, a semi ...[truncated 712 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fetch_rss.py:19

Finding

Predictable Shared Temporary Cache Path Permits Cache Manipulation and Unsafe File Writes

Content

View full analysis

2 else "/tmp/camelcamelcamel" cache_file = os.path.join(cache_dir, "cache.json") ``` ### Technical Analysis The default cache location is predictable and situated in the shared `/tmp` namespace. The code creates the directory and opens `cache.json` without checking ownership, permissions, file type, or whether any path component is a symbolic link. The cache is also loaded from the same attacker-influenceable location. A local user who can prepare or modify that path may inject arbitrary cache entries, remove entries, corrupt the JSON, or attempt to redirect writes through symbolic links. Whether write redirection succeeds depends on operating-system protections, directory ownership, and the permissions of the process running the script. The file is written directly rather than through an atomic create-and-replace operation. Concurrent invocations can therefore observe or produce incomplete cache data. ### Attack Path 1. A local attacker predicts the default path `/tmp/camelcamelcamel/cache.json`. 2. Before the scheduled task creates or accesses it, the attacker prepares the directory, cache file, or a symbolic-link path where local permissions permit. 3. During execution, `load_cache()` trusts data from that location, allowing the attacker to pre-populate hashes and suppress alerts or provide malformed JSON that disrupts the job. 4. During saving, `open(cache_file, 'w')` ...[truncated 776 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The implemented code aligns with the RSS monitoring and alert-detection portion of the description: it retrieves an RSS feed, parses alert items, caches seen entries, and identifies new alerts. However, the declared description explicitly says it sends Telegram notifications, and there is no Telegram integration, messaging API call, webhook use, or notification logic in the code. This is a material description-behavior mismatch because a key advertised capability is absent. The lack of declared permissions is not itself inconsistent with this specific code chunk, since it only performs network fetches and local file caching.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Clear the cache if you want to re-trigger notifications for existing alerts:

bash

rm /tmp/camelcamelcamel/cache.json

How It Works

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

Clear the cache if you want to re-trigger notifications for existing alerts:

bash

rm /tmp/camelcamelcamel/cache.json

How It Works

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/SETUP.md (reported line 50)May include surrounding context.

Clear the cache if you want to re-trigger notifications for existing alerts:

bash

rm /tmp/camelcamelcamel/cache.json

How It Works

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes capabilities that read from the network, write local cache files, and interact with notification mechanisms, but it declares no explicit tool scope or permissions. This weakens the trust boundary for the agent because consumers cannot clearly see or constrain what the skill is allowed to access, increasing the chance of overbroad execution in environments that honor manifest-declared permissions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/SETUP.md (reported line 30)May include surrounding context.

2. Configure Clawdbot to Check the Feed

Add a cron job to check the feed periodically (recommend every 1-6 hours):

bash

cron --action add \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes writing a cache file under /tmp/camelcamelcamel/cache.json and instructs the user to remove it, but it does not explicitly warn that local state will be created and that clearing it resets notification history. Because the category for markdown files focuses on user-data or system-impacting behaviors, a brief warning about local file creation/deletion would improve user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.