ClawHub
Back to skill

Security audit

News Sum Lite

Security checks for vulnerabilities and agentic risk

Overview

This news-summary skill is mostly coherent, but it tells the agent to save files and send an email through a local Gmail command without clear user approval or recipient controls.

Install only if you want the agent to create a local news archive and potentially send the report from your Gmail setup. Before use, require the agent to show the recipient, subject, body, and attachment path and get your confirmation before sending any email.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill presents itself as a lightweight one-shot news summarizer, but its documented behavior also writes to a local archive path and sends outbound email with an attachment. This mismatch is security-relevant because it hides side effects from the user and can lead to unauthorized file modification and data transmission beyond what the skill description implies.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill includes a shell-based email sending workflow with HTML generation and attachment handling, even though the stated purpose is only to generate a lightweight news brief. Introducing command execution and outbound email significantly expands the attack surface, creating risk of unintended exfiltration, misuse of local files as attachments, or unsafe parameter interpolation if placeholders are populated from untrusted input.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs writing output to a local archive file without any user-facing notice or consent. Undisclosed filesystem modification is dangerous because it creates persistent side effects, may overwrite existing content, and can be abused to store data in locations the user did not intend to modify.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill sends generated content and a file attachment via email without any warning or explicit approval flow. Outbound transmission is particularly sensitive because it can exfiltrate generated summaries, embedded links, or local files to external recipients, and the use of a shell command increases the risk if recipient or file parameters are influenced by untrusted input.

Static analysis

No suspicious patterns detected.