T09 · Insecure Skill Coding Practices
Error
- Location
wechat_push_config.json:3- Finding
Plaintext WeCom Webhook Credential Committed to the Project
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Hot Aggregator
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its hot-list automation purpose, but it ships credential-like secrets and an enabled external messaging configuration that users should review before installing.
Before installing, remove and rotate the bundled Weibo cookie and WeCom webhook key, replace the push config with your own disabled-by-default template, pin the installer version, and treat generated HTML reports as untrusted when they include platform-sourced content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
fetch_all.py:85- Finding
Hardcoded Weibo Session Cookie in Source Code
- Content
View full analysis
List[Dict]: """获取微博热搜 - 使用有效Cookie""" try: url = 'https://weibo.com/ajax/side/hotSearch' headers = { **self.headers, 'Referer': 'https://weibo.com/', 'Cookie': 'SUB=[REDACTED]' } req = urllib.request.Request(url, headers=headers) ``` The original source contains the complete `SUB` cookie. Its value is redacted here to avoid redistributing the credential. ### Technical Analysis A Weibo `SUB` cookie is embedded in the program and sent with every request to the hot-search endpoint. A `SUB` cookie is session-like authentication material and should be treated as sensitive, even when it is currently used only with a public-data endpoint. Anyone with access to the source can extract and replay the cookie outside the intended program. Its exact privileges and validity cannot be determined statically, but hardcoding it eliminates per-user isolation and prevents safe secret rotation. The implementation also catches all exceptions and reports only a warning. Consequently, expiration or unauthorized use may not be readily distinguishable from ordinary collection failures. ### Attack Path 1. An attacker obtains the project source or a distributed package. 2. The attacker extracts the complete `SUB` value from `fetch_all.py`. 3. The attacker inserts the cookie into independently crafted requests to Weibo. 4. If the cookie remains valid, Weibo treats those requests according to the session and privileges associated with the cookie. 5. The attacker accesses any endpoint or data that accepts the replayed session credential. ### Impact Assessment The maximum impact depends on the server-side privileges and current validity of the embedded cookie. Potential consequences i ...[truncated 371 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
analyzer.py:128- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
{label}' if label else '' items_html += f'''''' ``` Additional unescaped interpolation occurs in the keyword and report template generation around `analyzer.py:150` and `analyzer.py:159-161`. ### Technical Analysis The HTML report generator directly interpolates titles, labels, values, keywords, and date-derived data into an HTML document without contextual escaping. Titles and labels can originate from external platform responses collected by `fetch_all.py`. Reports can also be supplied or modified locally before `analyzer.py` loads them. A malicious value containing HTML markup can therefore break out of its intended text context. For example, an attacker-controlled title containing an image element with an event handler could execute JavaScript when a user opens the generated report in a browser. The generated document does not define a restrictive Content Security Policy, and inline event handlers are not otherwise blocked by the report. This is a stored injection issue: the malicious string first enters a JSON report, is persisted into an HTML file, and executes later when the file is viewed. ### Attack Path 1. An attacker influences a title, label, or value returned by a source platform, compromises an upst ...[truncated 1074 chars]{i}{item.get('title', '')}{value}{label_html}- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:19- Finding
Mutable Latest-Version Package Executed During Documented Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill markets itself as a hot-list retrieval tool, but also supports outbound WeCom webhook delivery and local push-group management, which are materially different capabilities. Outbound messaging increases risk because collected or derived content can be automatically transmitted to external endpoints, especially when paired with scheduled execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill markets itself as a hot-list retrieval tool, but also supports outbound WeCom webhook delivery and local push-group management, which are materially different capabilities. Outbound messaging increases risk because collected or derived content can be automatically transmitted to external endpoints, especially when paired with scheduled execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill markets itself as a hot-list retrieval tool, but also supports outbound WeCom webhook delivery and local push-group management, which are materially different capabilities. Outbound messaging increases risk because collected or derived content can be automatically transmitted to external endpoints, especially when paired with scheduled execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill markets itself as a hot-list retrieval tool, but also supports outbound WeCom webhook delivery and local push-group management, which are materially different capabilities. Outbound messaging increases risk because collected or derived content can be automatically transmitted to external endpoints, especially when paired with scheduled execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill markets itself as a hot-list retrieval tool, but also supports outbound WeCom webhook delivery and local push-group management, which are materially different capabilities. Outbound messaging increases risk because collected or derived content can be automatically transmitted to external endpoints, especially when paired with scheduled execution.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code embeds and transmits a hard-coded Weibo session cookie in outbound requests, which is effectively credential material. This can enable unauthorized use of a specific account/session, create privacy and account-abuse risk, and leak or normalize secret handling inside a reusable skill; in an aggregation utility, this is more dangerous because account-backed access is unnecessary for a broadly distributed public-data fetcher.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python # 设置控制台编码 if sys.platform == 'win32': os.system('chcp 65001 >nul 2>&1') sys.stdout.reconfigure(encoding='utf-8') sys.stderr.reconfigure(encoding='utf-8')
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python # 设置控制台编码 if sys.platform == 'win32': os.system('chcp 65001 >nul 2>&1') sys.stdout.reconfigure(encoding='utf-8') sys.stderr.reconfigure(encoding='utf-8')
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python # 设置控制台编码 if sys.platform == 'win32': os.system('chcp 65001 >nul 2>&1') sys.stdout.reconfigure(encoding='utf-8') sys.stderr.reconfigure(encoding='utf-8')
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python # 设置控制台编码 if sys.platform == 'win32': os.system('chcp 65001 >nul 2>&1') sys.stdout.reconfigure(encoding='utf-8') sys.stderr.reconfigure(encoding='utf-8')
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 85% confidence
- Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
- Content
python # 设置控制台编码 if sys.platform == 'win32': os.system('chcp 65001 >nul 2>&1') sys.stdout.reconfigure(encoding='utf-8') sys.stderr.reconfigure(encoding='utf-8')
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code can send arbitrary message content to arbitrary webhook URLs supplied via configuration, creating an unrestricted outbound data-transfer primitive. In the context of a hot-list aggregation skill, this is more dangerous because it is not clearly justified by the advertised functionality and could be abused to exfiltrate data or send unauthorized notifications to attacker-controlled endpoints.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to run
npx clawhub@latest install daily-hot-aggregator, which pulls and executes the latest package version at install time rather than a reviewed, pinned release. This creates a supply-chain risk: if the upstream package is compromised or a malicious version is published, users may execute attacker-controlled code simply by following the documentation.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and documents shell execution, network access, and local file read/write behavior, but the manifest does not declare any explicit tool scope or permissions. This creates a transparency and policy-enforcement gap: users and hosting systems cannot reliably constrain what the skill may do, especially given scheduled tasks and outbound webhook features.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents automatic enterprise WeChat pushing and scheduled collection/analysis, but does not prominently warn that content may be transmitted over the network or sent automatically on a schedule. In a skill context, silent or underexplained automation is dangerous because users may enable recurring tasks that continue exfiltrating content or metadata after initial setup.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
Using
npx clawhub@latestpulls an unpinned, moving version at install time, which exposes users to supply-chain risk if a future release is compromised or introduces unsafe behavior. Because installation is the trust boundary, version drift can silently change what code is executed on user systems.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The webhook setup instructions tell users how to configure an external WeCom webhook but do not clearly state that reports and derived content will be sent to a third-party service endpoint. This omission can lead to accidental disclosure of sensitive trending selections, internal analysis, or organization-specific reporting content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code presents its title, descriptions, CLI help text, and generated HTML entirely in Chinese, including an explicit zh-CN HTML locale later in the file. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill's purpose is aggregating and analyzing hot-list data, but on Windows it executes an OS shell command via os.system('chcp 65001 >nul 2>&1'). Spawning a shell is not an obvious requirement for trend analysis or report generation and introduces a capability outside the expected context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML output sets lang="zh-CN", which enforces a specific locale in generated user-facing content. The file does not provide a way for users to select another language/locale or explain why a China-specific locale is mandatory.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill manifest describes a 'one-click' cross-platform hot-ranking aggregator focused on collecting hot lists from B站、抖音、微博、头条. In this file, the documented purpose and implemented logic are instead to generate recommended content titles from preexisting report files, and the supported platforms are bilibili/douyin/weibo/xiaohongshu rather than including 头条.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring explicitly states '选题推荐工具 v1.0 - 根据热榜推荐自媒体选题', which frames the file as a recommendation generator rather than a hot-list aggregation component. This directly diverges from the manifest's declared intent of fetching and aggregating cross-platform hot rankings.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The HTTP header hard-codes
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific language/locale preference for all outbound requests. The file does not offer the user any language choice or document this as a justified region-specific constraint.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def fetch_bilibili(self, top: int = 10) -> List[Dict]: """获取B站热门""" try: url = 'https://api.bilibili.com/x/web-interface/popular?ps=' + str(top) headers = {**self.headers, 'Referer': 'https://www.bilibili.com/'} req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=10) as resp:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's natural-language description and all user-facing strings are fixed in Chinese, with no indication that the user can choose another language or that the tool is intentionally limited to a Chinese-only regional context. This can violate a language/locale policy when users have not opted into that language.
- Content
Static analysis
No suspicious patterns detected.