Auto news podcast

• Outcome: Review
• Latest audit: May 28, 2026 · 1:30 PM UTC
• Version: 1.0.12

Overview

The skill does what it claims, but it reuses broad local credentials and can automatically run other installed skills, so it needs review before installation.

Install only if you are comfortable with this skill reading OpenClaw model configuration and API keys, sending search terms/news text/prompts to external search and model providers, downloading remote images, and invoking separately installed helper skills. Use limited-scope API keys, verify model base URLs, and avoid pairing it with untrusted helper skills.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
            script_path = os.path.join(autoglm_skill, 'scripts', 'generate.py')
            if os.path.exists(script_path):
                result = subprocess.run(
                    [sys.executable, script_path,
                     '--prompt', prompt,
                     '--output', output_path],

• Confidence: 89% confidence
• Finding: The code executes another local skill via subprocess based on a fixed path under the user's home directory. Although it does not use shell=True and passes arguments as a list, this still expands the trust boundary: if that external skill is modified, replaced, or untrusted, this module will execute arbitrary code during image search.

Tainted flow: 'headers' from os.getenv (line 1682, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

'stream': False
        }
        
        response = requests.post(
            f'{api_base}/chat/completions',
            headers=headers,
            json=data,

• Confidence: 84% confidence
• Finding: The skill dynamically reads provider base URLs and API keys from a broad local OpenClaw configuration, then sends full prompts and aggregated news content to whatever endpoint that config specifies. If the local config is malicious, tampered with, or points to an untrusted host, this becomes credential exposure plus exfiltration of all generated prompt content to an attacker-controlled LLM endpoint.

Tainted flow: 'data' from input (line 1217, user input) → requests.post (network output)

Medium

• Category: Data Flow

Content

'stream': False
        }
        
        response = requests.post(
            f'{api_base}/chat/completions',
            headers=headers,
            json=data,

• Confidence: 81% confidence
• Finding: The prompt includes collected news content and generated script material, which are transmitted to an externally configured LLM endpoint without clear user approval. In a skill context, that can expose potentially sensitive user interests, prompts, and gathered content to third-party services beyond the obvious search providers.

Tainted flow: 'img_url' from requests.get (line 2193, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

img_url = urljoin(url, img_url)
                    
                    # 下载图片
                    img_response = requests.get(img_url, headers={
                        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                        'Referer': url
                    }, timeout=15)

• Confidence: 96% confidence
• Finding: The code fetches arbitrary image URLs extracted from remote news pages and then issues server-side HTTP requests to those URLs. Because the image URL is fully controlled by untrusted remote content, this creates an SSRF primitive that can be abused to probe internal services, cloud metadata endpoints, or other sensitive network locations accessible from the host running the skill.

Tainted flow: 'img_url' from requests.get (line 2285, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if data.get('results'):
                        for img in data['results']:
                            img_url = img['urls']['regular']
                            img_data = requests.get(img_url, timeout=15).content
                            if len(img_data) >= 10240:
                                with open(cover_path, 'wb') as f:
                                    f.write(img_data)

• Confidence: 95% confidence
• Finding: The Unsplash API response supplies img_url, and the code immediately downloads that URL server-side without validation. Even though Unsplash is a reputable service, treating any returned URL as safe is risky and can still enable SSRF or unexpected outbound fetches if the upstream response is manipulated or future behavior changes.

Tainted flow: 'img_url' from requests.get (line 181, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

img_url = urljoin(url, img_url)
                    
                    # 下载图片
                    img_response = requests.get(img_url, headers={
                        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                        'Referer': url
                    }, timeout=15)

• Confidence: 95% confidence
• Finding: The code fetches article pages from arbitrary news URLs, extracts img_url from untrusted HTML metadata/content, and then performs a second requests.get on that derived URL without validating scheme, host, or address range. This creates an SSRF-style network pivot where attacker-controlled pages can cause requests to internal services, cloud metadata endpoints, or unexpected local network targets.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The skill invokes another local skill script through subprocess for audio generation, which expands execution scope beyond simple content generation into arbitrary local program execution. Even if intended for TTS, subprocess use increases the attack surface because downstream scripts may process untrusted text, write files, or have their own unsafe behavior.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill instructs use of ffmpeg for audio concatenation, introducing shell or external process execution into a workflow that already handles variable user-derived content and file paths. While media processing is relevant to podcast creation, external command execution still creates risk if filenames, temporary paths, or concat lists are not strictly controlled.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill reads global OpenClaw configuration from the user's home directory to discover model providers and API keys, which exceeds the user-visible task of generating a news podcast. Accessing global config and secrets increases sensitivity because the skill can enumerate or misuse credentials unrelated to the immediate task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill reads broad global OpenClaw configuration, including model provider settings and potentially API credentials unrelated to the specific user request. In a skill ecosystem, that is dangerous because an otherwise simple content-generation skill gains access to cross-agent secrets and infrastructure configuration well beyond least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The module executes a Python script from a user-home skill directory (~/.agents/skills/autoglm-generate-image), which is a mutable local path outside the module's control. If that directory or script is replaced or tampered with, running this function will execute attacker-supplied code with the current user's privileges.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This image-search component silently chains into a separate AI image-generation skill, which is a broader capability than simple image retrieval. That increases attack surface and can surprise users by executing code from another skill package with its own dependencies and behaviors.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The skill automatically creates directories and multiple output files under the workspace without a prominent upfront warning or explicit confirmation. In context this is related to the skill's purpose, so it is less severe than arbitrary file writes, but silent writes can still surprise users and overwrite expectations about local state.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill silently reads sensitive API keys from configuration and environment and later uses them in outbound requests, without clear disclosure to the user. In a multi-skill environment, this is a privacy and trust-boundary issue because a content skill can consume ambient credentials the user did not knowingly authorize it to use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: User search terms are sent to external search providers without an explicit privacy warning or opt-in. Even if the skill's functionality implies search, queries may reveal sensitive interests, organizations, or topics the user did not expect to share with third parties.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Collected news content and generated prompts are bundled and sent to an external LLM provider without explicit disclosure. This is risky because the LLM endpoint may retain prompts, and the skill dynamically selects providers from a broad local configuration rather than a clearly disclosed fixed service.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The full generated script text is sent to external or helper TTS components without clear user warning. That script may contain sensitive topics, user-provided phrasing, or aggregated content the user did not expect to leave the local environment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/fetch_and_generate_v2.py:268

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:767