ClawHub
Back to skill

Security audit

Smart News

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill coherently documents an authenticated external news and intelligence API, including sensitive capabilities that users should configure carefully.

Install only if you intend to let an agent call this Crypto News Analyzer API with your bearer token. Confirm before using delete, archive, prompt-edit, topic-confirm, merge, or datasource association endpoints, and only configure Telegram/V2EX sources you are authorized to collect and process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## Datasource Management

Configure news and intelligence sources through the datasource API. Create sources with `POST /datasources`, list them with `GET /datasources`, and remove them with `DELETE /datasources/{id}`. All datasource routes require Bearer auth.

Each datasource has a `purpose` field: `news` (RSS/X/REST feeds for analysis) or `intelligence` (Telegram groups, V2EX for topic research). The `GET /datasources` endpoint supports optional `purpose` and `source_type` query parameters for filtering. Results are sorted by purpose, source type, then name.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `GET /semantic-search/{job_id}/result` - Retrieve completed semantic search results
- `POST /datasources` - Create a datasource
- `GET /datasources` - List all datasources
- `DELETE /datasources/{id}` - Delete a datasource
- `POST /telegram/webhook` - Telegram webhook receiver
- `POST /intelligence/topics` - Create topic draft (synchronous, Bearer-protected)
- `POST /intelligence/topics/{id}/revise` - Revise topic prompt
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `GET /intelligence/topics/{id}/datasources` - List datasource associations for a topic
- `PUT /intelligence/topics/{id}/datasources` - Replace all datasource associations atomically
- `POST /intelligence/topics/{id}/datasources/{datasource_id}` - Add a datasource association (idempotent)
- `DELETE /intelligence/topics/{id}/datasources/{datasource_id}` - Remove a datasource association (idempotent)
- `GET /intelligence/topics/{id}/runs` - List topic research run logs
- `GET /intelligence/topic-runs` - List all topic research runs globally
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
List responses always return safe summaries. For `rest_api` datasources, sensitive fields are redacted and replaced with counts.

### DELETE /datasources/{id}

Deletes a datasource by its UUID. Returns `204 No Content` on success, `404 Not Found` if the datasource does not exist, and `409 Conflict` if the datasource has active ingestion jobs.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Self-Modification

High
Category
Rogue Agent
Content
- The webhook is intended for infrastructure integration and bot delivery, not for manual invocation
- Configure the webhook path via environment variable to match your deployment routing needs

## Self-Update Workflow

When updating this skill reference to match code changes, follow this workflow to ensure accuracy.
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

External Transmission

Medium
Category
Data Exfiltration
Content
### Example Request

```bash
curl -X POST "https://news.tradao.xyz/analyze" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"hours": 1, "user_id": "my_agent_01"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
USER_ID="my_agent_01"

# 1. Create the job
CREATE_RESPONSE=$(curl -sS -X POST "${BASE_URL}/analyze" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"hours\":1,\"user_id\":\"${USER_ID}\"}")
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The reference expands the skill from 'smart-news' into broader intelligence collection, including hidden-channel sources, which creates a capability mismatch between the manifest description and the documented API surface. That mismatch can cause an agent or operator to invoke higher-risk collection features they would not reasonably expect from a news-analysis skill, weakening informed consent and scope-based safety controls.

External Transmission

Medium
Category
Data Exfiltration
Content
"source_type": "rest_api",
  "tags": [],
  "config_summary": {
    "endpoint": "https://api.example.com/news",
    "method": "GET",
    "response_mapping": {
      "title_field": "title",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document states that hidden-channel intelligence sources store raw text for 30 days and feed LLM extraction, but it does not present a clear user-facing privacy warning, consent requirement, or handling notice. This omission is dangerous because operators may ingest privacy-sensitive or confidential communications without understanding retention, downstream processing, or compliance implications.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Documenting Telegram hidden-channel collection inside a news skill materially increases risk because it enables collection from private or semi-private chats, including raw message ingestion and LLM extraction. In the context of a 'smart-news' skill, this is especially dangerous because the capability is not clearly justified, making misuse, overcollection, or unauthorized surveillance more likely.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill metadata/description understates the capability surface by framing the skill as analysis/search/management oriented while the reference clearly documents state-changing operations: create, revise, confirm, archive, and merge. This can mislead a caller or orchestrator into invoking mutating actions without appropriate user consent or safety gating, increasing the chance of unauthorized topic lifecycle changes.

External Transmission

Medium
Category
Data Exfiltration
Content
### Example

```bash
curl -X POST "https://news.tradao.xyz/intelligence/topics" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"theme": "crypto payment channels in Telegram groups"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Example

```bash
curl -X POST "https://news.tradao.xyz/intelligence/topics/topic-uuid/revise" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"feedback": "Focus on stablecoin settlement, exclude NFT marketplaces"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Example

```bash
curl -X PUT "https://news.tradao.xyz/intelligence/topics/topic-uuid/prompt" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"prompt_text": "Custom manual research prompt text..."}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Example

```bash
curl -X POST "https://news.tradao.xyz/intelligence/topics/topic-uuid/confirm" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"prompt_version_id": "prompt-uuid", "activation_notes": "Ready for daily research"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The findings response exposes message snippets and direct source URLs to original messages, which may reveal sensitive source content, identities, or private-channel linkage. Omitting an explicit warning increases the risk that operators will surface or redistribute this data without understanding the privacy and operational-security consequences.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The API contract explicitly requires sending a natural-language query and a user identifier, which may contain user-related or sensitive contextual data, but the skill description provides no caution about privacy, data minimization, or appropriate handling. Under the markdown-specific SQP-2 criteria, this omission is a missing user warning for behavior that could affect user data/privacy.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
This line indicates the service output is currently in Chinese and instructs consumers to preserve it as returned, which effectively imposes a specific language on users. SQP-3 applies because there is no opt-in, locale selection, or documented justification for the language restriction.

Missing User Warnings

Low
Confidence
81% confidence
Finding
This markdown skill file documents deletion and archival operations such as `DELETE /datasources/{id}` and later `POST /intelligence/topics/{topic_id}/archive`, but it does not explicitly warn users that these actions can remove or deactivate configured resources. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The manifest describes this skill as being for the Crypto News Analyzer HTTP API from OpenClaw, but the reference explicitly discusses a separate Telegram `/analyze` command behavior. Mentioning another interaction surface is not required to document the HTTP API workflow and broadens the apparent capability context beyond the stated purpose.

Context-Inappropriate Capability

Low
Confidence
85% confidence
Finding
The V2EX collection capability broadens the skill beyond news analysis into intelligence gathering and topic research, which is outside the apparent scope promised by the skill metadata. While less sensitive than Telegram, it still expands collection and inference power in ways that may bypass user expectations and internal least-privilege boundaries.

Intent-Code Divergence

Low
Confidence
99% confidence
Finding
The document states that intelligence endpoints are synchronous, but later defines merge endpoints as asynchronous and requiring polling. This inconsistency can cause incorrect client behavior, such as assuming immediate completion, skipping status checks, or mishandling partially completed operations.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The archive endpoint stops further scheduled research for a topic, which is a state-changing and potentially disruptive action. Without an explicit warning, users or agents may invoke it casually and unintentionally disable ongoing intelligence collection.

Missing User Warnings

Low
Confidence
80% confidence
Finding
This markdown file describes Bearer token authentication and later names required API keys, but it does not include any warning about protecting credentials, avoiding accidental exposure, or the fact that requests send user query and identifier data to an external service. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect privacy or system integrity.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
references/analyze-workflow.md:238