ClawHub
Back to skill

Security audit

Smart News

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill coherently documents an authenticated external news and intelligence API, including sensitive capabilities that users should configure carefully.

Install only if you intend to let an agent call this Crypto News Analyzer API with your bearer token. Confirm before using delete, archive, prompt-edit, topic-confirm, merge, or datasource association endpoints, and only configure Telegram/V2EX sources you are authorized to collect and process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
## Datasource Management

Configure news and intelligence sources through the datasource API. Create sources with `POST /datasources`, list them with `GET /datasources`, and remove them with `DELETE /datasources/{id}`. All datasource routes require Bearer auth.

Each datasource has a `purpose` field: `news` (RSS/X/REST feeds for analysis) or `intelligence` (Telegram groups, V2EX for topic research). The `GET /datasources` endpoint supports optional `purpose` and `source_type` query parameters for filtering. Results are sorted by purpose, source type, then name.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
- `GET /semantic-search/{job_id}/result` - Retrieve completed semantic search results
- `POST /datasources` - Create a datasource
- `GET /datasources` - List all datasources
- `DELETE /datasources/{id}` - Delete a datasource
- `POST /telegram/webhook` - Telegram webhook receiver
- `POST /intelligence/topics` - Create topic draft (synchronous, Bearer-protected)
- `POST /intelligence/topics/{id}/revise` - Revise topic prompt

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
- `GET /intelligence/topics/{id}/datasources` - List datasource associations for a topic
- `PUT /intelligence/topics/{id}/datasources` - Replace all datasource associations atomically
- `POST /intelligence/topics/{id}/datasources/{datasource_id}` - Add a datasource association (idempotent)
- `DELETE /intelligence/topics/{id}/datasources/{datasource_id}` - Remove a datasource association (idempotent)
- `GET /intelligence/topics/{id}/runs` - List topic research run logs
- `GET /intelligence/topic-runs` - List all topic research runs globally

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/datasource-management.md (reported line 58)May include surrounding context.

md
List responses always return safe summaries. For `rest_api` datasources, sensitive fields are redacted and replaced with counts.

### DELETE /datasources/{id}

Deletes a datasource by its UUID. Returns `204 No Content` on success, `404 Not Found` if the datasource does not exist, and `409 Conflict` if the datasource has active ingestion jobs.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/operations-and-maintenance.md (reported line 41)May include surrounding context.

md
- The webhook is intended for infrastructure integration and bot delivery, not for manual invocation
- Configure the webhook path via environment variable to match your deployment routing needs

## Self-Update Workflow

When updating this skill reference to match code changes, follow this workflow to ensure accuracy.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/analyze-workflow.md (reported line 43)May include surrounding context.

Example Request

bash
curl -X POST "https://news.tradao.xyz/analyze" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"hours": 1, "user_id": "my_agent_01"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/analyze-workflow.md (reported line 233)May include surrounding context.

md
USER_ID="my_agent_01"

# 1. Create the job
CREATE_RESPONSE=$(curl -sS -X POST "${BASE_URL}/analyze" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"hours\":1,\"user_id\":\"${USER_ID}\"}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference expands the skill from 'smart-news' into broader intelligence collection, including hidden-channel sources, which creates a capability mismatch between the manifest description and the documented API surface. That mismatch can cause an agent or operator to invoke higher-risk collection features they would not reasonably expect from a news-analysis skill, weakening informed consent and scope-based safety controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/datasource-management.md (reported line 172)May include surrounding context.

md
"source_type": "rest_api",
  "tags": [],
  "config_summary": {
    "endpoint": "https://api.example.com/news",
    "method": "GET",
    "response_mapping": {
      "title_field": "title",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document states that hidden-channel intelligence sources store raw text for 30 days and feed LLM extraction, but it does not present a clear user-facing privacy warning, consent requirement, or handling notice. This omission is dangerous because operators may ingest privacy-sensitive or confidential communications without understanding retention, downstream processing, or compliance implications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Documenting Telegram hidden-channel collection inside a news skill materially increases risk because it enables collection from private or semi-private chats, including raw message ingestion and LLM extraction. In the context of a 'smart-news' skill, this is especially dangerous because the capability is not clearly justified, making misuse, overcollection, or unauthorized surveillance more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill metadata/description understates the capability surface by framing the skill as analysis/search/management oriented while the reference clearly documents state-changing operations: create, revise, confirm, archive, and merge. This can mislead a caller or orchestrator into invoking mutating actions without appropriate user consent or safety gating, increasing the chance of unauthorized topic lifecycle changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/intelligence-query.md (reported line 68)May include surrounding context.

Example

bash
curl -X POST "https://news.tradao.xyz/intelligence/topics" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"theme": "crypto payment channels in Telegram groups"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/intelligence-query.md (reported line 93)May include surrounding context.

Example

bash
curl -X POST "https://news.tradao.xyz/intelligence/topics/topic-uuid/revise" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"feedback": "Focus on stablecoin settlement, exclude NFT marketplaces"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/intelligence-query.md (reported line 120)May include surrounding context.

Example

bash
curl -X PUT "https://news.tradao.xyz/intelligence/topics/topic-uuid/prompt" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"prompt_text": "Custom manual research prompt text..."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/intelligence-query.md (reported line 146)May include surrounding context.

Example

bash
curl -X POST "https://news.tradao.xyz/intelligence/topics/topic-uuid/confirm" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"prompt_version_id": "prompt-uuid", "activation_notes": "Ready for daily research"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The findings response exposes message snippets and direct source URLs to original messages, which may reveal sensitive source content, identities, or private-channel linkage. Omitting an explicit warning increases the risk that operators will surface or redistribute this data without understanding the privacy and operational-security consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The API contract explicitly requires sending a natural-language query and a user identifier, which may contain user-related or sensitive contextual data, but the skill description provides no caution about privacy, data minimization, or appropriate handling. Under the markdown-specific SQP-2 criteria, this omission is a missing user warning for behavior that could affect user data/privacy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This line indicates the service output is currently in Chinese and instructs consumers to preserve it as returned, which effectively imposes a specific language on users. SQP-3 applies because there is no opt-in, locale selection, or documented justification for the language restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown skill file documents deletion and archival operations such as DELETE /datasources/{id} and later POST /intelligence/topics/{topic_id}/archive, but it does not explicitly warn users that these actions can remove or deactivate configured resources. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes this skill as being for the Crypto News Analyzer HTTP API from OpenClaw, but the reference explicitly discusses a separate Telegram /analyze command behavior. Mentioning another interaction surface is not required to document the HTTP API workflow and broadens the apparent capability context beyond the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The V2EX collection capability broadens the skill beyond news analysis into intelligence gathering and topic research, which is outside the apparent scope promised by the skill metadata. While less sensitive than Telegram, it still expands collection and inference power in ways that may bypass user expectations and internal least-privilege boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document states that intelligence endpoints are synchronous, but later defines merge endpoints as asynchronous and requiring polling. This inconsistency can cause incorrect client behavior, such as assuming immediate completion, skipping status checks, or mishandling partially completed operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The archive endpoint stops further scheduled research for a topic, which is a state-changing and potentially disruptive action. Without an explicit warning, users or agents may invoke it casually and unintentionally disable ongoing intelligence collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file describes Bearer token authentication and later names required API keys, but it does not include any warning about protecting credentials, avoiding accidental exposure, or the fact that requests send user query and identifier data to an external service. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect privacy or system integrity.

Content

No source excerpt is available for this finding.