tech-news-bulletin

• Outcome: Review
• Latest audit: May 28, 2026 · 11:42 AM UTC
• Version: 1.0.0

Overview

The skill is a real tech-news email bulletin, but it can automatically send email from the user's SMTP account to hard-coded recipients and shares article text with a fixed HTTP summarizer.

Review and edit EMAIL_ADDRESSES before setting SMTP credentials or running the skill. Only enable the cron job if recurring outbound email is intended, and only use the fixed Ollama endpoint if you trust it to receive article text and possible feed content. Treat /tmp/openclaw-debug.log as containing digest content until logging is reduced or redirected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'text' from requests.get (line 279, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

try:
        logging.debug(f"Summarizing article with Ollama: {text}...")
        resp = requests.post(
            "http://172.20.86.203:11434/api/generate",
            json={
                "model": model,

• Confidence: 92% confidence
• Finding: Untrusted article text fetched from arbitrary URLs is forwarded to a separate summarization service, creating a clear data-flow from external input to another network sink. In this skill's context, article pages can contain unexpected or sensitive content, and the code sends up to 2000 characters to an internal HTTP endpoint without sanitization, minimization beyond truncation, or any disclosure/consent boundary.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill uses sensitive capabilities including environment variables and outbound network access, but does not declare corresponding permissions. This weakens transparency and policy enforcement, making it harder for users or the platform to understand that the skill can access SMTP credentials and communicate with external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior understates materially important actions: fetching third-party content, sending article content to an external LLM endpoint, and emailing to configured recipients. This mismatch can cause unreviewed data exfiltration or unintended outbound actions because users may invoke the skill without realizing their content and credentials will be used in broader ways than described.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script contains a hard-coded list of recipient email addresses and will automatically send the compiled digest to them whenever SMTP credentials are present. That creates an exfiltration path to fixed third parties that is stronger than a user-configured mailing feature and is risky because fetched and generated content is distributed without runtime confirmation or tenant-specific control.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill does not prominently warn users that it will send emails to configured recipients and transmit collected content over SMTP and other network channels. In a skill that automatically aggregates and distributes content, lack of clear notice increases the risk of unintended disclosure, surprise outbound messaging, and misuse of stored SMTP credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code transmits article contents to an external summarization service without any user-facing notice, policy check, or consent mechanism. Even if the target is an internal host, this is still a disclosure risk because raw fetched content leaves the immediate processing path and may be logged, retained, or inspected by another service.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The script logs raw article text before summarization and later logs the full generated HTML digest, both to a plaintext file in /tmp. This can expose fetched content, embedded sensitive strings, recipient-facing output, and model responses to other local users or processes, especially because /tmp is a shared location on many systems.

Static analysis

No suspicious patterns detected.