ClawHub
Back to skill

Security audit

Trump Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clear malware, but it overstates live Trump tracking while using generic or hardcoded news data and weakens feed integrity by disabling TLS checks.

Install only in a virtual environment, review or pin the dependencies first, and do not treat the output as reliable live Trump news or financial/political forecasting. The maintainer should remove verify=False, clearly label fallback data as sample or cached data, and either add Trump-specific filtering or revise the description.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/trump_monitor.py:33
Finding

TLS Certificate Verification Disabled for RSS Requests

Content
View full analysis

Vulnerability Details

File Location: scripts/trump_monitor.py:33
Vulnerability Type: Improper certificate validation
Risk Level: Medium

Vulnerable Code

python
with requests.get(url, timeout=10, headers=headers, stream=True, verify=False) as resp:
    if resp.status_code != 200:
        print(f"[!] Source {url} was restricted (HTTP {resp.status_code})")
        continue
    content = resp.raw.read()

Technical Analysis

The verify=False argument explicitly disables TLS certificate and hostname validation. Although the configured RSS sources use HTTPS, the application does not verify that the server presenting the certificate is the legitimate owner of the requested domain.

An attacker able to intercept or redirect network traffic could consequently impersonate an RSS provider and return attacker-controlled feed content. The response is parsed by Feedparser and BeautifulSoup, after which titles, publication dates, and summaries are displayed and supplied to the prediction model.

The retrieved content is treated as data rather than executable code, so this issue does not independently provide direct code execution. It nevertheless compromises the integrity and authenticity of all remotely obtained news data.

Attack Path

  1. A user runs scripts/trump_monitor.py or scripts/trump_predictor.py on an attacker-observable network.
  2. The attacker gains a network interception position, manipulates DNS resolution, or controls an upstream proxy.
  3. The attacker presents an arbitrary TLS certificate while impersonating one of the configured RSS hosts.
  4. Because certificate verification is disabled, Requests accepts the connection.
  5. The attacker returns a forged RSS document containing manipulated titles and summaries.
  6. The application parses, displays, and scores the forged content as if it came from the configured news provider.

Impact Assessment

The attacker can control ...[truncated 474 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove verify=False and retain Requests' default certificate validation:

    python
    with requests.get(
    url,
    timeout=10,
    headers=headers,
    stream=True
) as resp:
    resp.raise_for_status()
    content = resp.raw.read()

  2. Ensure the runtime uses a maintained CA trust store, such as the current certifi bundle.

  3. Do not suppress TLS warnings as a substitute for restoring validation.

  4. Consider applying an explicit maximum response size before reading the full response body.

  5. Validate that parsed documents are plausible RSS or Atom feeds before processing their entries.

  6. Log certificate and connection failures without falling back to an insecure transport mode.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Executable Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4; dependency installation and execution occur at install_deps.py:11-15
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code

requirements.txt:

text
requests
feedparser
beautifulsoup4
textblob

install_deps.py:

python
subprocess.check_call([sys.executable, "-m", "pip", "install", "-r", "requirements.txt"])

# TextBlob requires additional corpora
print("\n[*] Downloading TextBlob corpora...")
subprocess.check_call([sys.executable, "-m", "textblob.download_corpora"])

Technical Analysis

Every dependency is specified without a version constraint or integrity hash. Each installation can therefore resolve to a different package release depending on the package-index state at that time. The resulting environment is not reproducible, and no cryptographic allowlist verifies that downloaded distributions match artifacts reviewed by the project maintainer.

Python package installation may execute package build logic, while later imports execute package initialization code. The installer additionally invokes the installed textblob.download_corpora module directly. A compromised future package release, compromised package-index account, malicious index configuration, or substituted distribution could therefore execute code under the identity running the installer.

The package names shown are established package names, and the reviewed project does not contain evidence that they are currently malicious. The risk arises from resolving mutable, unverified future artifacts rather than from a confirmed malicious dependency.

Attack Path

  1. An attacker compromises a dependency publisher, an applicable package index, or the user's pip index configuration.
  2. The attacker makes a malicious distribution available under one of the unpinned dependency names.
  3. A user runs ` ...[truncated 1072 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to a reviewed version.

  2. Generate a lock file containing cryptographic hashes for all permitted distributions.

  3. Install with hash enforcement, for example:

    bash
    python -m pip install --require-hashes -r requirements.lock

  4. Generate locks separately for each supported Python version and platform when their dependency graphs differ.

  5. Restrict installation to an explicitly configured trusted package index and disable unintended extra indexes.

  6. Install inside a dedicated virtual environment without administrative privileges.

  7. Review dependency updates through a controlled process that includes vulnerability scanning, provenance checks, and tests.

  8. Document and pin the corpora downloaded by TextBlob where feasible, including their expected source and integrity metadata.

  9. Avoid running the dependency installer as root, an administrator, or another privileged service account.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill's declared purpose does not match its observed behavior: it claims Trump-specific monitoring and predictive modeling, but analysis indicates generic feed collection, no real prediction capability, and undeclared external/network and local file access. This mismatch is dangerous because users may grant trust or permissions based on false expectations, enabling hidden data collection or broader behavior than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README instructs users to execute an installer script directly without describing what it installs, what files or system settings it changes, or any safety checks. This is dangerous because installer scripts commonly perform network fetches, package installation, or environment modifications, and encouraging blind execution increases the chance of supply-chain abuse or unexpected system changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares no explicit tool scope or permissions even though its described and detected capabilities include network, file read, and shell execution. This creates an authorization gap where a user or orchestrator cannot accurately understand or constrain what the skill may do, increasing the risk of unintended data access, command execution, or external communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file describes the skill primarily in Chinese and labels outputs such as the prediction model in a way that assumes Chinese-language usage, without stating that the user can choose their preferred language or locale. This can violate language/locale policy when a skill imposes a language by default rather than offering opt-in or choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · install_deps.py (reported line 11)May include surrounding context.

python
print("==================================================")
    
    try:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "-r", "requirements.txt"])
        
        # TextBlob 需要额外的语料库
        print("\n[*] 正在下载 TextBlob 语言包 (Downloading corpora)...")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · install_deps.py (reported line 15)May include surrounding context.

python
# TextBlob 需要额外的语料库
        print("\n[*] 正在下载 TextBlob 语言包 (Downloading corpora)...")
        subprocess.check_call([sys.executable, "-m", "textblob.download_corpora"])
        
        print("\n✅ 所有依赖已安装完成！ (All dependencies installed successfully!)")
        print("💡 现在你可以运行: python scripts/trump_predictor.py")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes both real-time Trump monitoring and a prediction model, but this file only fetches RSS feeds, parses entries, and returns titles/summaries. There is no scoring, inference, forecasting, or model logic that would justify the claimed prediction capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request headers force Accept-Language to en-US,en, which imposes a specific locale preference regardless of user settings or consent. This is a natural-language/locale policy issue because the skill does not offer any language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

Disabling TLS certificate verification with verify=False makes HTTPS connections vulnerable to man-in-the-middle interception and content tampering. Because this skill ingests remote RSS content and then parses and displays it, an attacker on the network path could spoof feeds, inject misleading data, or potentially deliver malicious payloads via downstream consumers.

Content

Scanner excerpt · scripts/trump_monitor.py (reported line 33)May include surrounding context.

python
for url in self.sources:
            try:
                # 使用 stream=True 处理可能存在的传输长度不一致问题
                with requests.get(url, timeout=10, headers=headers, stream=True, verify=False) as resp:
                    if resp.status_code != 200:
                        print(f"[!] 源 {url} 捕捉受限 (HTTP {resp.status_code})")
                        continue

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The inline comment and status message describe the fallback as an "AI 实时同步" live cache, which implies active AI-backed synchronization. In reality, the code only checks for a local file and reads it with json.load, with no AI component or synchronization logic present.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

When RSS fetching fails, the code prints that it is loading the 'latest global live-capture updates' and comments that it is synchronizing real-time hotspots, but it actually assigns a fixed in-code list of news items. This is an active contradiction between the documentation/messages and the implementation, not merely omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README states that all analysis results are provided in both Chinese and English, which imposes a language/locale behavior by default. The file does not indicate that users can choose a preferred language or opt out of bilingual output.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency specification leaves requests unpinned, so installs may resolve to different versions over time, including versions with known security defects or breaking changes. This creates a supply-chain and reproducibility risk because the security posture of the environment cannot be verified from the manifest alone.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests
feedparser
beautifulsoup4
textblob

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
94% confidence
Finding

requests has multiple published advisories, and because no version is pinned, there is no way to determine whether installation will select an affected release. In a skill that likely fetches external web content, this uncertainty is more relevant because requests may handle untrusted URLs, redirects, authentication, or TLS-sensitive operations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

feedparser is declared without a version constraint, so dependency resolution may select an outdated or vulnerable release depending on environment and timing. That makes builds non-reproducible and prevents auditors from determining whether known feedparser issues are present.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests
feedparser
beautifulsoup4
textblob

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

feedparser has known historical advisories, and the lack of version pinning makes it impossible to verify whether a vulnerable release will be installed. Given this skill's stated purpose of monitoring live content, parsing untrusted feeds increases the importance of using a patched version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

beautifulsoup4 is unpinned, which weakens reproducibility and leaves open the possibility of pulling an unexpected or compromised version during installation. While not proof of an exploitable bug by itself, this is a valid supply-chain hygiene issue.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
requests
feedparser
beautifulsoup4
textblob

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

textblob is unpinned, so the installed package version may vary across systems and over time. This reduces build integrity and can expose the skill to vulnerable or incompatible releases without visibility.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
requests
feedparser
beautifulsoup4
textblob

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The configured sources are broad international/world-news RSS feeds rather than Trump-specific feeds or any filtering for Trump-related content. As written, the skill collects generic global news, so its behavior is broader and less targeted than the stated purpose suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Lines L137-L140 explicitly override stdout encoding to UTF-8 on Windows, imposing a specific output encoding regardless of the user's existing console locale or preferences. This is a natural-language policy concern because it enforces a locale-related behavior without offering a choice or documenting an opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.