ClawHub
Back to skill

Security audit

新闻头条 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This news skill appears purpose-built, but it sends the user's API key over unencrypted HTTP and also documents weaker ways to handle that key.

Install only if you are comfortable using a Juhe API key with this skill. Before real use, prefer JUHE_NEWS_KEY over --key, avoid committing scripts/.env, and update the endpoints to HTTPS if Juhe supports it; otherwise your API key and returned news data can be exposed or modified on the network.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/news_headlines.py:25
Finding

API Key Transmitted Through Plaintext HTTP Query Strings

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/news_headlines.py:194
Finding

API Key Accepted Through a Process Command-Line Argument

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill instructs users to store the API key in a plaintext .env file under the scripts directory, which is a common location that may be read by tooling, packaged accidentally, or committed to source control. This increases the chance of credential leakage and unauthorized use of the API key.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
export JUHE_NEWS_KEY=你的AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_NEWS_KEY=你的AppKey" > scripts/.env

# 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The documentation recommends passing the API key directly on the command line, which can expose the secret through shell history, process listings, logging, and telemetry. Command-line arguments are routinely visible to other local users or monitoring tools, making this a higher-risk credential-handling practice.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export JUHE_NEWS_KEY=你的AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_NEWS_KEY=你的AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/news_headlines.py --key 你的AppKey --type top

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/news_headlines.py (reported line 12)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_NEWS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_NEWS_KEY=your_api_key
    3. 直接传参: python news_headlines.py --key your_api_key --type top

免费申请 API Key: https://www.juhe.cn/docs/api/id/235

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/news_headlines.py (reported line 241)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_NEWS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_NEWS_KEY=your_api_key
    3. 直接传参: python news_headlines.py --key your_api_key --type top

免费申请 API Key: https://www.juhe.cn/docs/api/id/235

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/news_headlines.py (reported line 45)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises executable behavior that uses environment variables, local file access, and outbound network access, but it does not declare an explicit tool scope or permission boundary. This can cause the host agent to invoke the skill with broader capabilities than users expect, reducing transparency and making accidental misuse of secrets or network access more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation examples are broad enough that common phrases like '新闻列表' or general requests for headlines may trigger the skill in situations where the user did not clearly consent to a third-party lookup. Over-broad triggering increases the chance of unintended external requests and unnecessary sharing of user queries with the API provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Although the document mentions Juhe as the data provider, it does not clearly warn users that their query text will be transmitted to an external third-party service. This weakens informed consent and may expose user interests or sensitive phrasing to the provider without an explicit privacy notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script explicitly supports passing the API key on the command line, which can expose the secret through shell history, process listings, job-control logs, and operational tooling. While this is not code execution, it is a real credential-handling weakness because the script documents and encourages an unsafe secret-delivery method without warning users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language policy violations apply to all file types, including code docstrings and printed strings. This script forces a specific language for usage instructions and runtime messages, with no indication that users can choose another locale or that the tool is region-specific by design.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.