Blogwatcher Moss

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:11 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent RSS/blog monitoring helper, but it installs an unpinned third-party executable whose reviewed behavior can change later.

Install only if you are comfortable running the current upstream blogwatcher Go command. Prefer a pinned reviewed version, verify the feed URLs you add, and expect the tool to contact those sites and keep local tracking data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Go Dependency Installed from a Mutable Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 13
Vulnerability Type: Supply-chain risk caused by an unpinned executable dependency
Risk Level: Medium

Vulnerable code snippets:

yaml

metadata: {"clawdbot":{"emoji":"📰","requires":{"bins":["blogwatcher"]},"install":[{"id":"go","kind":"go","module":"github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest","bins":["blogwatcher"],"label":"Install blogwatcher (go)"}]}}

shell

go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest

Technical Analysis

The installation metadata and documentation instruct the user or agent to install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest. The @latest selector is mutable: it resolves the dependency version at installation time rather than identifying the exact version that was reviewed.

The Go toolchain retrieves the selected source code, compiles it, and installs an executable. Consequently, the behavior installed in the future can differ from the behavior available when this Skill was audited. The project provides no immutable version or commit pin, expected checksum, signature, or provenance verification for the executable dependency.

This is a supply-chain weakness rather than evidence that the current upstream project is malicious. The local package contains no executable scripts, and no malicious behavior was identified in the two reviewed files.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or a future release selected by @latest.
2. The attacker introduces malicious behavior into the upstream blogwatcher command.
3. A user or agent follows the Skill's installation metadata or documented command.
4. The Go toolchain retrieves and compiles the attacker-controlled latest source.
5. The resulting executable is installed and subsequently invoked as the trusted blogwatcher command.
6. The malicious executable oper ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, immutable semantic version in both the installation metadata and documentation, for example:

   shell

   go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@vX.Y.Z
   

2. Keep the version in line 5 synchronized with the command documented on line 13.
3. Review upstream source and release provenance before updating the pinned version.
4. Use Go module checksum verification and retain expected dependency information in a controlled build process.
5. Where available, verify signed releases, attestations, or reproducible build output before distributing or invoking the binary.
6. Run the installed tool with least privilege and restrict access to unnecessary credentials and sensitive files.
7. Adopt an explicit dependency-update process so upgrades are reviewed and tested rather than selected dynamically during installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to add blogs and scan feeds but does not disclose that these operations perform outbound network requests and persist tracking state locally. While this is expected behavior for an RSS-monitoring tool, the lack of warning can cause unanticipated network access or unintended modification of a local feed database, which is a real but low-severity safety/documentation issue.

Content

No source excerpt is available for this finding.