ClawHub
Back to skill

Security audit

tech-news-bulletin

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its newsletter purpose, but it can automatically use a user's SMTP account to email hard-coded third-party recipients and fetch feed-controlled article URLs without adequate guardrails.

Review and edit scripts/bulletin.py before installing or running: replace EMAIL_ADDRESSES, use least-privilege SMTP credentials, avoid enabling the cron job until recipients are confirmed, and restrict article fetching and the Ollama endpoint to trusted destinations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bulletin.py:277
Finding

Unrestricted Fetching of Feed-Controlled Article URLs Enables SSRF

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bulletin.py:35
Finding

Hard-Coded Third-Party Recipient List Causes Unintended Email Disclosure

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:43
Finding

Unpinned Python Dependencies Create Supply-Chain and Reproducibility Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior understates what the skill does: it sends content to a hardcoded Ollama endpoint, may fetch full article pages beyond the stated feeds, and may email hardcoded recipients. This mismatch is dangerous because reviewers and users cannot accurately assess data flows, which can lead to unapproved exfiltration of content, internal-network interaction, and unintended outbound email delivery.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares environment-variable and network capabilities in metadata but does not define an explicit tool scope such as permissions or allowed-tools. That weakens containment and reviewability, making it easier for the skill to access sensitive credentials and perform outbound network actions without clear user-visible authorization boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is designed to send email to configured recipients but does not require recipient verification or provide a user-facing warning before outbound transmission. In context, this increases the chance of sending generated content to unintended recipients or using the skill as an unreviewed exfiltration path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation instructs operators to provide SMTP credentials via environment variables without warning about secure handling, storage, or least-privilege use. In a skill that performs outbound email and network access, this raises the risk of credential misuse, accidental leakage, or reuse of high-privilege mailbox credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it collects and sends a digest, but the implementation additionally transmits article bodies to a remote Ollama endpoint for summarization. That extra external disclosure is security-relevant because operators may not expect third-party/internal-service sharing of fetched content, and the service is contacted over plain HTTP.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This duplicate finding points to the same outbound POST to 172.20.86.203 carrying article text. The danger is not the existence of networking alone, but that fetched content is relayed to another host over an unauthenticated cleartext channel without clear disclosure.

Content

Scanner excerpt · scripts/bulletin.py (reported line 288)May include surrounding context.

python
try:
        logging.debug(f"Summarizing article with Ollama: {text}...")
        resp = requests.post(
            "http://172.20.86.203:11434/api/generate",
            json={
                "model": model,

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This duplicate finding points to the same outbound POST to 172.20.86.203 carrying article text. The danger is not the existence of networking alone, but that fetched content is relayed to another host over an unauthenticated cleartext channel without clear disclosure.

Content

Scanner excerpt · scripts/bulletin.py (reported line 288)May include surrounding context.

python
try:
        logging.debug(f"Summarizing article with Ollama: {text}...")
        resp = requests.post(
            "http://172.20.86.203:11434/api/generate",
            json={
                "model": model,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Article content is sent to a remote summarization service with no user-facing warning, consent, or configuration toggle. Even if the content is public, undisclosed outbound transmission to another service expands the data exposure surface and can have compliance or trust implications.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/bulletin.py (reported line 288)May include surrounding context.

python
try:
        logging.debug(f"Summarizing article with Ollama: {text}...")
        resp = requests.post(
            "http://172.20.86.203:11434/api/generate",
            json={
                "model": model,

Tainted flow: 'text' from requests.get (line 279, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
92% confidence
Finding

The code fetches full article text from arbitrary external URLs and forwards that content to a separate summarization service at 172.20.86.203 without validating trust boundaries or minimizing disclosure. This creates a real data-flow issue because untrusted remote content is retransmitted to another system, which may violate data-handling expectations and can expose internal processing to prompt-injection-style manipulation of the summarizer.

Content

Scanner excerpt · scripts/bulletin.py (reported line 288)May include surrounding context.

python
try:
        logging.debug(f"Summarizing article with Ollama: {text}...")
        resp = requests.post(
            "http://172.20.86.203:11434/api/generate",
            json={
                "model": model,

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/bulletin.py (reported line 347)May include surrounding context.

python
if not summary and article.get('description'):
            desc = article['description']
            # TLDR AI articles: use the full curated summary without truncation
            if article.get('source') == 'TLDR AI':
                summary = desc
            else:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script accesses sensitive environment variables SMTP_EMAIL and SMTP_PASSWORD, then uses them to authenticate to Gmail and send emails. Although this is functionally necessary, the file lacks a user-facing warning or explicit documentation comment alerting operators that credentials are required and will be used for outbound email.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function docstring and module description describe sending a tech and AI news bulletin, but the actual From display name is set to 'AI Health Bulletin'. This is an active contradiction in user-facing intent and could mislead recipients about the nature of the message.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The code accesses environment variables for SMTP credentials to authenticate and send mail. While email delivery is part of the stated purpose, credential access is a sensitive capability that is not reflected in the manifest description and goes beyond simple collection/merging behavior described there.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.