ClawHub
Back to skill

Security audit

全网新闻聚合助手

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its configurable network fetching and Feishu sharing need review before installation.

Before installing, use only trusted public HTTPS news feeds, avoid internal or private URLs, run it with restricted outbound network access if possible, and review the Feishu chat destination and token handling. Update the flagged dependencies and expect generated news data, digests, and 30 days of push history to remain on disk.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch.js:45
Finding

Unrestricted Source URLs Permit Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/push.js:145
Finding

Failed Feishu Deliveries Are Incorrectly Recorded as Successful

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
node scripts/push.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
node scripts/push.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
| `filter.js` | 按关键词过滤并分类新闻 |

Known Vulnerable Dependency: axios==1.15.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-44489 (Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pol) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins axios to 1.15.2, and the provided advisory set indicates multiple known high-severity issues affecting that exact version. Because axios is a network-facing HTTP client used by a news aggregator, flaws such as MITM facilitation, header injection, or denial of service are especially relevant when fetching remote content from untrusted sources.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
90% confidence
Finding

form-data 4.0.5 is flagged with a CRLF injection vulnerability, and this exact version is present in the dependency tree. If multipart field names or filenames are influenced by untrusted input, this can enable header/body manipulation in outbound requests, which is dangerous in applications that communicate with external services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.25.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High
Category
Supply Chain
Confidence
92% confidence
Finding

undici 7.25.0 is listed with multiple high-severity advisories, and it is included transitively through cheerio. In a news aggregation skill that fetches and parses remote content, HTTP queue poisoning, response desynchronization, or information disclosure issues are particularly concerning because the application processes attacker-controlled servers and responses.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.15.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-44489 (Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pol) +13 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

The manifest permits installation of an axios version identified by the scanner as having multiple known advisories, including risks such as denial of service and header/prototype-pollution-related attacks. This is more dangerous in a news aggregation skill because it routinely performs outbound network requests to potentially untrusted endpoints and may run unattended on a schedule, increasing exposure surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation describes local history storage and Feishu message delivery in configuration and feature sections, but it does not present a prominent user-facing warning about data persistence and outbound sharing before use. This can cause users to unknowingly retain scraped content on disk and transmit aggregated material into chat conversations, creating privacy, compliance, or information-disclosure risk depending on the news sources and added content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This JSON config embeds Chinese-only topic labels and matching keywords, which implies the skill is tailored to a specific language/locale. Because the file provides no documented opt-in, fallback, or language selection, it may violate the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The package description is written entirely in Chinese and presents the skill in that language without any indication that users can choose another language or locale. The policy for this audit flags language or locale constraints when they are imposed without opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script explicitly formats output time using the 'zh-CN' locale, and the generated digest strings throughout the file are in Chinese. This imposes a specific language/locale choice in the skill behavior without any visible user selection or documented opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language descriptions and runtime console messages in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific. That matches the policy category for language or locale constraints in natural-language content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends the generated digest to the Feishu API, which is a network transmission of potentially user- or system-derived content. While there is a general push log message, there is no explicit warning in code comments or user-facing disclosure that the digest content will leave the local system and be sent to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's natural-language strings and description are entirely in Chinese, including the title and operational log messages, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when users are not given a choice or informed of the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language strings and comments indicate the skill is intended to operate in Chinese, and all user-facing console output is also hard-coded in Chinese. This can violate language/locale policy when no user opt-in or documented regional justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content of the skill is entirely in Chinese, including setup and usage instructions, which effectively forces a specific language for users. Under the policy, a language constraint should either be optional for the user or explicitly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
79% confidence
Finding

uuid 8.3.2 is flagged for a low-severity bounds-check issue when certain v3/v5/v6 buffer APIs are used. This is a real vulnerable version, but the practical risk depends on whether the application invokes the affected API surface with attacker-controlled buffer arguments; in this dependency tree it appears transitively via node-cron, so exploitability is less certain than the other findings.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using a caret version for axios allows installation of newer compatible releases without strict reproducibility, which can unexpectedly introduce vulnerable or malicious upstream changes. In a network-facing news aggregation skill that fetches remote content, dependency integrity matters because compromised HTTP client behavior can affect all fetch operations.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"author": "肥肥🐶",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "node-cron": "^3.0.3",
    "rss-parser": "^3.13.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Using a non-exact cheerio version reduces build reproducibility and increases supply-chain risk from unintended upstream changes. Because this skill parses untrusted remote HTML/news content, parser behavior changes can have downstream security and stability implications.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "node-cron": "^3.0.3",
    "rss-parser": "^3.13.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

A caret-pinned node-cron dependency permits silent drift across patch/minor versions, which weakens reproducibility and can expose the scheduled execution path to supply-chain issues. Since this package is intended to run unattended on a schedule, dependency trust is especially important.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "node-cron": "^3.0.3",
    "rss-parser": "^3.13.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

A non-exact rss-parser version introduces supply-chain and reproducibility risk by allowing unreviewed upstream updates. Because the skill consumes external feeds automatically, any vulnerable or compromised parser update could affect all ingestion runs.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
"axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "node-cron": "^3.0.3",
    "rss-parser": "^3.13.0"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This file contains natural-language text such as the header description and runtime log messages exclusively in Chinese. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring at L059-L061 and the implementation of buildFeishuPost at L062-L104 indicate the script is intended to create a Feishu rich-text/post message. However, the actual API request at L139-L143 ignores that payload and sends msg_type 'text' with truncated raw digest text, which directly contradicts the documented intent of the helper and surrounding comments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Feishu post content is hardcoded under the zh_cn locale, which indicates the skill is fixed to Chinese output. The file does not provide any user opt-in, locale selection, or documented justification that this skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/push.js:137