Hotspot Aggregator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:14 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its news-aggregation purpose, but it contains unsafe shell execution and broad hard-coded local/OpenClaw paths that make installation risky.

Review before installing. Use this only in a contained environment, avoid enabling cron or npm run daily, and do not run --send until the shell-command sender is replaced with a non-shell API or execFile-style call and the data paths are made install-relative and validated. Treat generated reports as untrusted summaries of public feeds, especially before giving them to an AI agent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate-daily-report.js:154

Finding

Arbitrary Shell Command Injection Through Report Content and Recipient Configuration

Content

View full analysis

10) { const cmd = `openclaw message send --channel openclaw-weixin --account d72d5b576646-im-bot --target "${notifyUser}" --message "${section.replace(/"/g, '\\"')}"`; try { execSync(cmd, { stdio: 'pipe' }); ``` ### Technical Analysis The function constructs a shell command by interpolating two untrusted values: - `notifyUser`, loaded from `~/.openclaw/hotspot/config.json`. - `section`, derived from Markdown containing externally retrieved RSS titles and descriptions. Only double quotation marks in `section` are escaped. This does not prevent shell evaluation inside double-quoted strings. Shell constructs such as command substitution with `$(...)` or backticks remain active. `notifyUser` is not escaped or validated at all. The resulting string is passed to `execSync`, which invokes a shell. Consequently, malicious report content or configuration data can inject commands that execute with the privileges of the user running the report generator. ### Attack Path 1. An attacker gains control of content returned by an RSS source, compromises an upstream feed, or causes a malicious title or description to appear in a feed. 2. The malicious field contains shell syntax such as `$(attacker_command)`. 3. `scripts/fetch-hotspots.js` stores the field without removing shell metacharacters. 4. The report generator incorporates the field into the Markdown report. 5. A user or scheduled process invokes: ```bash node scripts/generate- ...[truncated 977 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate-daily-report.js:182

Finding

Path Traversal Through the Unvalidated Date Argument

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/generate-daily-report.js:14

Finding

Indirect Prompt Injection Through Untrusted RSS Content in AI-Oriented Reports

Content

View full analysis

([\s\S]*?)<\/item>/g; const titleRegex = /([^<]+)<\/title>/; const linkRegex = /<link>([^<]+)<\/link>/; const pubDateRegex = /<pubDate>([^<]+)<\/pubDate>/; const descriptionRegex = /<description>([\s\S]*?)<\/description>/; let match; while ((match = itemRegex.exec(xml)) !== null) { const itemXml = match[1]; const title = titleRegex.exec(itemXml)?.[1] || ''; const link = linkRegex.exec(itemXml)?.[1] || ''; const pubDate = pubDateRegex.exec(itemXml)?.[1] || ''; const description = descriptionRegex.exec(itemXml)?.[1] || ''; items.push({ title: title.trim(), link, pubDate, description: description.trim() }); } ``` The untrusted fields are then embedded directly into an AI-oriented Markdown report: ```js function generateMarkdown(data) { let md = `# 🔥 每日热点 - ${data.date}\n\n`; md += `> 生成时间：${new Date(data.generatedAt).toLocaleString('zh-CN')}\n\n`; md += `---\n\n`; // 各平台热榜 for (const source of data.sources) { md += `## ${source.name} TOP${Math.min(source.items.length, 20)}\n\n`; source.items.slice(0, 20).forEach((item, i) => { const emoji = getHotEmoji(i); md += `${emoji} **${i + 1}. ${item.title}**\n`; if (item.description) { md += ` - ${truncate(item.description, 50)}\n`; } md += `\n`; }); md += `---\n\n`; } // 跨平台热点 md += `## 🌐 跨平台热点\n\n`; const crossPlatform = getCrossPlatformHotspots(data.all_items); crossPlatform.slice(0, 10).forEach((item, i) => { md += `${i + 1}. **${item.title}**\n`; md += ` ...[truncated 2498 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate-daily-report.js:154

Finding

Predictable Temporary File Enables Symlink-Based File Overwrite

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior goes beyond simple hot-topic aggregation by including local filesystem persistence, scheduled execution, external publication to a public account, vector-database storage, and collection of a WeChat identifier. That mismatch undermines informed consent and can lead users to enable a skill with broader data handling and outbound communication than its description suggests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill demonstrates capabilities implying network access, shell/cron invocation, and local environment/file interaction, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause a host agent to grant broader access than users expect, especially for a skill that schedules jobs and performs external fetches.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to create and persist configuration under ~/.openclaw/hotspot, which introduces session persistence and durable storage of settings such as sources and notification identifiers. Persistence is not inherently malicious, but when done without lifecycle, protection, or disclosure guidance, it can expose personal data and leave long-lived state that later tooling may reuse unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

2. 配置（可选）

bash

mkdir -p ~/.openclaw/hotspot
cat > ~/.openclaw/hotspot/config.json << 'EOF'
{
  "sources": ["weibo", "zhihu", "douyin", "36kr"],

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The configuration example asks the user to provide a WeChat ID for notifications without explaining how that contact information is stored, used, protected, or deleted. Contact identifiers are personal data, and collecting them silently increases privacy risk and the chance of unintended notification abuse or leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow states that generated reports are published to a public account and stored in a vector database, but it does not clearly warn users about external dissemination and long-term persistence. Even if the content is 'public hot topics,' generated summaries, enrichment, or associated metadata may still create privacy, compliance, or reputational risks once published or indexed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 9)May include surrounding context.

sh

echo "🦆 安装 hotspot-aggregator 技能..."

# 创建数据目录
mkdir -p ~/.openclaw/hotspot
mkdir -p "$(dirname "$0")/data"

# 创建配置文件

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description is entirely in Chinese and presents the skill as producing a daily report in that locale, with no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-language/regional audience. Under the policy, locale constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language strings and usage text entirely in Chinese, beginning with the top-level description and continuing throughout user-facing console output. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented region-specific justification is a policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Hard-coding a write into another extension's directory is a genuine boundary violation that is not required for fetching public RSS feeds. If a cooperating or compromised downstream extension reads these files as trusted input, this script can become an injection point for untrusted external content, enabling data poisoning, misleading automation, or file clobbering across skill boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script includes an outbound delivery feature that sends generated report contents to a WeChat account, which expands the capability from local aggregation/report generation into external data transmission. Even if intended for convenience, this creates a data exfiltration path for scraped or synthesized content and can violate least-privilege or user-expectation boundaries when not clearly declared and gated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends report content to an external WeChat channel without presenting a meaningful user-facing warning or confirmation about what data will leave the local environment. This weakens informed consent and can lead to unintended disclosure of generated content, especially if reports contain sensitive, regulated, or unexpectedly private material from upstream sources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code builds a shell command with interpolated recipient and message content, then executes it with execSync. This is dangerous because untrusted data in notifyUser or section can break shell quoting and potentially trigger command injection, while also enabling external transmission through a messaging CLI.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description focuses on aggregating hot lists from multiple platforms and generating an AI-friendly daily report. In addition to aggregation and formatting, this code classifies topics by sentiment and attaches prescriptive response suggestions such as how an AI should react to celebrity scandals, finance, or opinion prompts, which is a broader behavior than simple report generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes output to a hard-coded path inside another extension's directory (/home/lin/.openclaw/extensions/openclaw-weixin/skills/hotspot-aggregator/...), creating an unexpected cross-component side effect. In an agent/extension environment, this can overwrite or inject data into a separate skill's workspace, weakening isolation and enabling downstream trust abuse if that other component consumes the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated timestamp is explicitly formatted with toLocaleString('zh-CN'), which hard-codes a specific language/locale behavior. The file does not provide a user opt-in, configuration option, or documented regional justification for always using the Chinese locale.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate-daily-report.js:166