ClawHub
Back to skill

Security audit

V002

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly fetches public trending lists, but its install/dependency setup and inaccurate feature claims need review before use.

Review the package before installing. Prefer a pinned clawhub installer version, avoid running npm install unless the python npm dependency is removed or audited, expect only Bilibili/Douyin/Toutiao fetching to work, do not provide account cookies for unsupported platforms, and use --output only with a path you intend to overwrite.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Mutable Package Version Executed Through npx Installation Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

bash
npx clawhub@latest install daily-hot-aggregator

Technical Analysis

The documented installation command directs npx to retrieve and execute the mutable latest release of the clawhub package. Because no exact version or integrity value is specified, the code executed during installation can change after this Skill has been audited.

This creates a supply-chain trust boundary in which control of the package registry account, publication pipeline, or package distribution infrastructure can alter the installer subsequently executed by users. The repository itself does not contain the retrieved package, so its behavior cannot be verified as part of this static audit.

Attack Path

  1. An attacker compromises the package maintainer account, publication credentials, build pipeline, or upstream distribution channel.
  2. The attacker publishes a malicious package release and causes it to resolve through the latest tag.
  3. A user follows the installation instructions and runs npx clawhub@latest install daily-hot-aggregator.
  4. npx downloads and executes the attacker-controlled package.
  5. The malicious installer executes with the privileges and environmental access of the user who invoked the command.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's account. The accessible scope may include that user's files, environment variables, credentials available to the process, network access, and writable project or configuration directories. This finding does not demonstrate that the current upstream package is malicious; it identifies the risk caused by executing a mutable, externally controlled package version.

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Commit and enforce an appropriate lockfile where package-manager installation is part of the project workflow.
  • Verify package provenance and integrity before execution, using registry integrity metadata, signed releases, or an equivalent trusted verification mechanism.
  • Document the expected package publisher and version so users can detect substitutions.
  • Review new installer versions before updating the pinned version.
  • For higher-assurance environments, download and inspect the installer separately instead of allowing npx to retrieve and execute it in one step.

T08 · Insecure Dependencies

Note
Location
package.json:26
Finding

Unnecessary and Broadly Versioned npm Dependency Named python

Content
View full analysis

Vulnerability Details

File Location: package.json, lines 26–28
Vulnerability Type: Unnecessary unpinned third-party dependency
Risk Level: Low

json
"dependencies": {
  "python": ">=3.7"
}

Technical Analysis

The project declares an npm dependency named python with the broad version constraint >=3.7. This declaration does not install or constrain the system Python interpreter used by fetch_all.py; it refers to a package from the npm ecosystem. The Skill metadata already identifies the python3 executable as the required runtime, making this npm dependency unnecessary for the implemented functionality.

The open-ended range allows npm to resolve future releases that have not been audited with this project. Installing dependencies may consequently introduce package-controlled code, transitive dependencies, or lifecycle scripts unrelated to the Skill's actual Python runtime requirement.

Attack Path

  1. A user or automated build process runs npm install in the project directory.
  2. npm resolves a permitted release of the package named python, including a future release allowed by >=3.7.
  3. npm downloads that package and any transitive dependencies.
  4. If the resolved package or its dependency chain has been compromised, package-controlled lifecycle behavior may execute during installation.
  5. Such behavior runs with the privileges and environmental access of the account performing the installation.

Impact Assessment

Exploitation through a compromised resolved package could result in code execution under the npm-installing user's privileges. Potential exposure includes project files, user-readable files, environment variables, network access, and writable npm or user configuration locations. No evidence in the audited repository establishes that the currently resolved npm package is malicious; the confirmed issue is the unnecessary exposure to a mutable third-party dependency a ...[truncated 20 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the python entry from dependencies.
  • Declare Python 3 as a runtime prerequisite in the Skill metadata and installation documentation rather than as an npm package.
  • If npm dependencies are added for legitimate functionality, pin reviewed versions and commit a lockfile with integrity hashes.
  • Disable unnecessary npm lifecycle scripts in controlled build environments where feasible.
  • Add automated dependency review and vulnerability scanning to detect unexpected package or transitive-dependency changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documentation claims broader platform coverage than is actually implemented, including mentioning Weibo while noting elsewhere that it requires cookies and is not functional. This mismatch can mislead users about what external services are accessed, what credentials may be needed, and what the skill actually does, which undermines informed consent and safe deployment.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · fetch_all.py (reported line 23)May include surrounding context.

python
# 设置控制台编码
if sys.platform == 'win32':
    os.system('chcp 65001 >nul 2>&1')
    sys.stdout.reconfigure(encoding='utf-8')
    sys.stderr.reconfigure(encoding='utf-8')

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub@latest install daily-hot-aggregator, which fetches and executes the latest published package version at install time rather than a pinned, reviewed release. If the upstream package is compromised, typosquatted, or updated maliciously, users could execute attacker-controlled code directly on their systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding

The skill advertises executable usage involving Python, shell installation via npx, and likely network/data output behavior, but it does not declare any tool scope such as permissions or allowed-tools. This can cause the agent or user to run a skill with broader capabilities than are transparently documented, increasing the risk of unintended file writes, shell execution, or network access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

Using 'npx clawhub@latest' pulls the latest package version at install time, which creates a supply-chain risk because future package changes could introduce malicious or unsafe behavior without notice. In a skill context, this is especially risky because users may copy-paste the command and execute remote code from an unpinned dependency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's natural-language interface and output strings are consistently fixed in Chinese, and the HTTP Accept-Language header is also pinned to zh-CN. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only compliance or regional context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fetch_all.py (reported line 41)May include surrounding context.

python
def fetch_bilibili(self, top: int = 10) -> List[Dict]:
        """获取B站热门"""
        try:
            url = 'https://api.bilibili.com/x/web-interface/popular?ps=' + str(top)
            headers = {**self.headers, 'Referer': 'https://www.bilibili.com/'}
            req = urllib.request.Request(url, headers=headers)
            with urllib.request.urlopen(req, timeout=10) as resp:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest description explicitly promises four platforms including 微博. In code, the aggregate fetch path only calls fetch_bilibili, fetch_douyin, and fetch_toutiao, with no 微博 implementation anywhere in the file, so the delivered behavior is narrower than advertised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description is written entirely in Chinese and presents the skill as such without indicating any user language choice or opt-in. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says the skill provides hotlists for 'B站+抖音+微博+头条', while the README states '6大平台：B站、微博、小红书、抖音、百度、知乎'. This is a semantic mismatch in advertised behavior and scope: the documented implementation surface differs from the manifest's claimed platform coverage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description focuses on one-click retrieval of platform hotlists, but the README additionally advertises 'AI 智能摘要', 'Telegram/微信/邮件' push, and scheduled execution. Those are materially broader behaviors than simple aggregation, so the manifest understates the skill's described functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The visible natural-language description and headings force a single language for all users, with no opt-in or alternative language option. Under the stated policy, this is a language/locale constraint that should either be optional for users or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill notes that some platforms require cookies or authorization, but it does not provide a clear warning about privacy, account exposure, or safe handling of authenticated session data. Users may supply credentials or cookies without understanding the risks of leakage, reuse, or unintended collection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

A skill whose purpose is to fetch and aggregate trending topics would be expected to make network requests and format output. Spawning a shell command to run chcp is an extra capability unrelated to the core hot-list retrieval purpose.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · fetch_all.py (reported line 185)May include surrounding context.

python
# 获取数据
    all_data = {}
    for platform in platforms:
        method = getattr(aggregator, f'fetch_{platform}', None)
        if method:
            all_data[platform] = method(args.top)

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest frames the skill as a hot-list fetcher/aggregator, which implies retrieval and presentation of rankings. The --output path adds a persistent file-writing capability that is not mentioned in the description and goes beyond simple on-screen aggregation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script writes to an arbitrary path supplied via --output with no validation, restrictions, or warning beyond the flag itself. In an agent or automation context, this can be abused to overwrite unintended files, drop data into sensitive locations, or clobber user content if arguments are influenced by untrusted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language description is entirely in Chinese and presents the skill in that locale without any indication that other languages are supported or that the locale is intentional. Under the policy, language-specific behavior should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.