Security audit

Ai Cv Weekly

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent report-generation tool, but it includes overly broad network and local-code execution bridges that should be reviewed before installation.

Install only if you are comfortable with a briefing tool that can make outbound web requests, call a configured LLM provider in standalone mode, and render reports through a browser. Avoid enabling skill_proxy except for explicitly trusted modules, do not allow untrusted users to supply RSS feed URLs or task_config values, and prefer running it in an isolated environment with pinned dependencies and restricted network egress.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: clawcat/adapters/news/rss.py:27
Finding: Unrestricted RSS URLs Permit Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: clawcat/adapters/search/skill_proxy.py:60
Finding: Caller-Controlled Python Module and Function Invocation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: clawcat/nodes/write_section.py:43
Finding: Fetched Web Content Can Perform Indirect Prompt Injection
Content: View full analysis
str: line = f"- {s.get('title', '')}: {s.get('summary', s.get('text', ''))}" facts = s.get("key_facts", []) if facts: line += f"\n 关键数值：{' | '.join(facts)}" return line summaries_text = "\n".join(_format_summary(s) for s in summaries) section = client.chat.completions.create( model=get_model(), response_model=GroundedSection, messages=[ { "role": "system", "content": WRITE_SECTION_SYSTEM.format( period=task.period, topic=task.topic, heading=plan.heading, section_type=plan.section_type, description=plan.description, item_count=plan.suggested_item_count, since=task.since, until=task.until, target_audience=task.target_audience, tone_desc=tone_desc, focus_areas=focus_text, claw_comment_i ...[truncated 2895 chars]
Remediation: View remediation
... ``` 5. Add explicit instructions that quoted source text cannot modify goals, tools, policies, output destinations, or disclosure rules. 6. Detect and quarantine instruction-like phrases before LLM processing. 7. Preserve source identifiers and URLs through every transformation so claims can be checked against their original records. 8. Perform deterministic validation of generated claims and URLs rather than relying only on another LLM. 9. Restrict output source URLs to URLs present in retrieved source records. 10. Add adversarial tests containing instructions in titles, snippets, RSS summaries, repository descriptions, and numeric fields. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: clawcat/templates/base.html:7
Finding: Report Rendering Executes Mutable Third-Party JavaScript
Content: View full analysis
@import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC:wght@400;500;700&display=swap'); ``` The renderer loads that HTML in a Playwright browser and waits for network activity: ```python from playwright.sync_api import sync_playwright with sync_playwright() as p: browser = p.chromium.launch(channel="chrome") pdf_page = browser.new_page() pdf_page.set_content(html, wait_until="networkidle") pdf_out = out / f"{prefix}_{ts}.pdf" pdf_page.pdf( path=str(pdf_out), format="A4", print_background=True, ) pdf_path_str = str(pdf_out) pdf_page.close() png_ctx = browser.new_context( viewport={"width": 390, "height": 800}, device_scale_factor=2, ) png_page = png_ctx.new_page() png_page.set_content(html, wait_until="networkidle") png_out = out / f"{prefix}_{ts}.png" png_page.screenshot(path=str(png_out), full_page=True) ``` ### Technical Analysis `https://cdn.tailwindcss.com` is a remotely controlled executable resource. The report renderer runs it while the complete report is present in the page DOM. The resource is not bundled locally, pinned to a content hash, or protected by Subresource Integrity. No restrictive Content Security Policy or Playwright request interception is applied. A compromised CDN, upstream package, DNS route, or TLS trust path could therefore supply modified JavaScript after the Skill has been reviewed. That script w ...[truncated 1470 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:3
Finding: Production Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=2.0 pydantic-settings[yaml] # Data sources feedparser httpx aiohttp>=3.9 akshare pandas # Search engines ddgs baidusearch # Rendering jinja2>=3.1 playwright # Config & utilities pyyaml>=6.0 ``` ### Technical Analysis Most dependencies are specified without exact versions, and the remaining constraints permit broad future versions. No integrity hashes or reviewed lockfile are present. As a result, installing the same project at different times can retrieve materially different code. This increases exposure to: - Compromised future package releases - Accidental breaking changes - Newly introduced transitive dependencies - Dependency resolution inconsistencies - Unreviewed changes in network, parsing, LLM, and browser-rendering components The audit did not establish that any named package is currently malicious. The finding concerns unsafe supply-chain reproducibility and the inability to guarantee that reviewed dependency code is the code later installed. ### Attack Path 1. An operator installs the project using `pip install -r requirements.txt`. 2. The package index resolves the latest versions satisfying the broad constraints. 3. A dependency or transitive dependency has changed since the project was audited. 4. The newly resolved package executes during installation, import, or runtime. 5. The package receives the privileges and data available to the application process. ### Impact Assessment A compromised dependency may have the same effective permissions as the application, including potential access to: - LLM API keys and other environment variables - GitHub tokens supplied to adapters - Local report and profile files - Network connect ...[truncated 167 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (87)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PLAN.md (reported line 322)May include surrounding context.
md
"""ClawCat configuration — powered by pydantic-settings. Loads from: environment variables > .env > config.yaml (descending priority). """ from __future__ import annotations

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 174)May include surrounding context.
md
"""ClawCat configuration — powered by pydantic-settings. Loads from: environment variables > .env > config.yaml (descending priority). """ from __future__ import annotations

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawcat/config.py (reported line 3)May include surrounding context.
python
"""ClawCat configuration — powered by pydantic-settings. Loads from: environment variables > .env > config.yaml (descending priority). """ from __future__ import annotations

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawcat/config.py (reported line 81)May include surrounding context.
python
"""ClawCat configuration — powered by pydantic-settings. Loads from: environment variables > .env > config.yaml (descending priority). """ from __future__ import annotations

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawcat/config.py (reported line 56)May include surrounding context.
python
model_config = SettingsConfigDict( yaml_file=["config.yaml", "config.local.yaml"], yaml_file_encoding="utf-8", env_file=".env", env_nested_delimiter="__", extra="ignore", )

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill_proxy feature allows the skill to invoke arbitrary external/local modules by module and function name, which greatly exceeds the stated scope of a report-generation tool. This creates a powerful execution bridge that could be abused to access unintended capabilities, trigger side effects in other installed skills, or expand network/data access without clear trust boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains extensive natural-language instructions and acceptance criteria exclusively in Chinese, including the title at L001 and all subsequent operational guidance. Because the document does not offer users a language/locale choice or explain that the skill is intentionally region-specific, it may violate a language or locale policy requiring user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill plan is presented entirely in Chinese and labels itself as a '完整技术方案', with no indication that users may choose another language or locale. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level skill description states the product in Chinese only and frames it as a general-purpose briefing engine, but nowhere in the README does it indicate that the skill supports other languages or requires Chinese by design. For a broadly described skill, this creates a natural-language locale constraint without user opt-in or justification.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · clawcat/adapters/finance/akshare_macro.py (reported line 30)May include surrounding context.
python
pmi = latest.get("制造业-Loss", latest.get("PMI", "")) items.append(Item( title=f"中国制造业PMI: {pmi}", url="https://data.eastmoney.com/cjsj/pmi.html", source="akshare_macro", raw_text=f"日期: {date_val}, PMI: {pmi}", published_at=datetime.now().isoformat(),

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · clawcat/adapters/finance/akshare_macro.py (reported line 47)May include surrounding context.
python
pmi = latest.get("制造业-Loss", latest.get("PMI", "")) items.append(Item( title=f"中国制造业PMI: {pmi}", url="https://data.eastmoney.com/cjsj/pmi.html", source="akshare_macro", raw_text=f"日期: {date_val}, PMI: {pmi}", published_at=datetime.now().isoformat(),

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This manifest contains multiple adapter entries with hard-coded language values such as 'en' and 'zh', and some guidance explicitly requires English or Chinese keywords. Because the file does not indicate that users can opt into these language constraints, it presents a natural-language locale policy concern under the rule for forced language without user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The registry exposes a generic skill_proxy adapter that can invoke an arbitrary installed Python module and function based on configuration (skill_module, skill_function). This materially expands the trust boundary from a fixed set of built-in adapters to any locally installed skill, enabling unintended code execution paths, data exfiltration, or use of unreviewed third-party logic if an attacker can influence configuration or installed packages.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This adapter dynamically imports and executes arbitrary configured modules/functions for what is described as a search normalization bridge, creating a powerful execution primitive far beyond normal data transformation needs. If an attacker can influence configuration or available Python modules, they can cause arbitrary code execution, invoke unexpected side effects during import, or run non-search functions under the application's privileges.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · clawcat/adapters/tech/github_trending.py (reported line 61)May include surrounding context.
python
try: async with new_client() as client: resp = await client.get( "https://api.github.com/search/repositories", params={"q": q_str, "sort": sort, "order": "desc", "per_page": str(per_query)}, headers=headers, )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's usage examples and argument help all present report requests exclusively in Chinese, which implicitly steers users toward a single language. There is no accompanying natural-language indication that other languages are supported or that the Chinese-only framing is a deliberate, justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code emits a natural-language message in Chinese (数值 ... 在素材中找不到来源，可能为 LLM 编造) when reporting grounding issues. Because the skill does not provide user opt-in, fallback localization, or documentation that it is intentionally Chinese-only, it violates the language/locale policy for natural-language output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The embedded instruction explicitly requires the model to '使用中文撰写' (write in Chinese). This imposes a fixed language policy in natural-language instructions, and the file does not show any user choice or clear region-specific justification for restricting output to Chinese.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring states that items without published_at are discarded as part of the freshness guarantee, but the implementation only checks date bounds when published_datetime is not None. As a result, undated items bypass the time filter and are admitted into filtered_items, undermining any downstream assumption that all output is time-bounded and fresh.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language system prompt requires Chinese output, including Chinese section titles, rather than offering a language choice. This is a locale/language policy issue because the file imposes a specific language without evidence of user opt-in or a clearly documented region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The planner injects the full serialized UserProfile into the system prompt sent to the LLM, which can expose personal or sensitive user data to a third-party model provider or downstream logging/retention systems. Because this happens automatically and there is no visible consent, minimization, or redaction in this file, the privacy risk is real and increased by the broad model_dump_json() serialization of the entire profile.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction '使用中文撰写' mandates Chinese for all rewritten sections. The surrounding code does not offer a language choice or document that this is a region-specific or user-requested constraint, which creates a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code sends the full section JSON, audience/tone metadata, and issue text to an external chat completion client. There is no confirmation prompt, user-facing notice, or explanatory comment/docstring near the network operation to disclose that document content is being transmitted for revision.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The embedded system prompt is entirely in Chinese and instructs the model to act in that language, but the code does not offer a language choice or indicate that this is a justified region-specific constraint. This can violate language/locale policy when users have not opted into Chinese output.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: No manifest is available, so there is no stated purpose justifying outbound model calls. This file transmits task metadata and item summaries to an LLM via chat completions, which is a meaningful external-processing capability that cannot be validated against any declared intent.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: clawcat/llm.py:18

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: clawcat/adapters/registry.json:180

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.yaml:22