ClawHub
Back to skill

Security audit

ai-news-oracle

Security checks for vulnerabilities and agentic risk

Overview

The skill’s news API behavior is mostly purpose-aligned, but its installation identity is inconsistent and it sends requests through a third-party API key without strong privacy scoping.

Before installing, verify which publisher and repository are authoritative, prefer a pinned reviewed release or registry package, and avoid sending secrets or private internal context through the SkillBoss-powered briefing flow. Use a scoped SkillBoss API key if possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned and Inconsistent Remote Installation Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44; README.md:8; README.md:13
Vulnerability Type: Supply-chain exposure through mutable and inconsistent installation sources
Risk Level: Medium

Vulnerable Code

SKILL.md:44:

bash
openclaw install skill https://github.com/swimmingkiim/openclaw-skill-ai-news-oracle

README.md:8:

bash
clawhub install modesty-ai-news-oracle

README.md:13:

bash
git clone https://github.com/ModestyRichards/ai-news-oracle.git

Technical Analysis

The installation instructions retrieve mutable Skill content without specifying an immutable commit hash, verified release artifact, checksum, or cryptographic signature. A later change to an upstream repository or registry package can therefore cause users to install content different from the artifact reviewed in this audit.

The documented sources are also inconsistent. SKILL.md identifies and installs from the swimmingkiim GitHub account, while README.md directs manual installation from ModestyRichards and registry installation through modesty-ai-news-oracle. The audited files provide no verification that these sources contain equivalent content or are controlled by the same trusted publisher.

This is a supply-chain weakness rather than evidence that the currently audited two-file artifact contains an executable malicious payload. The risk arises when a user follows the installation instructions and trusts mutable, insufficiently authenticated upstream content.

Attack Path

  1. An attacker compromises, acquires, or otherwise gains publishing access to one of the documented GitHub repositories or the associated registry entry.
  2. The attacker modifies the remote Skill by adding malicious instructions, executable scripts, excessive permission requests, or credential-exfiltration behavior.
  3. A user follows one of the unpinned installation commands.
  4. The package manager o ...[truncated 973 chars]
Remediation
View remediation

Remediation Suggestions

  1. Designate one authoritative repository and publisher identity, then make the author metadata and all installation instructions consistent.
  2. Pin installation to a reviewed immutable commit hash or versioned release rather than the repository's mutable default branch.
  3. Publish checksums or cryptographic signatures for release artifacts and require verification before installation.
  4. Configure the registry package to reference the same authoritative source and verified release.
  5. Document the expected repository owner, package identifier, release version, commit hash, and integrity value.
  6. Review updates before activation and avoid granting newly introduced permissions automatically.
  7. Treat a change in repository ownership, registry publisher, requested permissions, or integrity metadata as requiring a new security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill clearly sends user search queries and retrieved news content to SkillBoss's third-party API for both search and summarization, but the description does not prominently warn users that their inputs and fetched content are externally transmitted for processing. This creates a privacy and transparency issue because agents may pass sensitive prompts or internal context to an external service without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
- **Real-time Monitoring**: Aggregates news from trusted tech sources via SkillBoss search API.
- **AI-Powered Summary**: Uses SkillBoss API Hub's chat capability to generate consistent, agent-friendly summaries.
- **Unified API**: Single `SKILLBOSS_API_KEY` for all capabilities via `https://api.skillboss.co/v1/pilot`.

## Tools

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
- **Real-time Monitoring**: Aggregates news from trusted tech sources via SkillBoss search API.
- **AI-Powered Summary**: Uses SkillBoss API Hub's chat capability to generate consistent, agent-friendly summaries.
- **Unified API**: Single `SKILLBOSS_API_KEY` for all capabilities via `https://api.skillboss.co/v1/pilot`.

## Tools

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
- **Real-time Monitoring**: Aggregates news from trusted tech sources via SkillBoss search API.
- **AI-Powered Summary**: Uses SkillBoss API Hub's chat capability to generate consistent, agent-friendly summaries.
- **Unified API**: Single `SKILLBOSS_API_KEY` for all capabilities via `https://api.skillboss.co/v1/pilot`.

## Tools

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The example code performs an authenticated POST to an external API and sends the request body directly, which includes user query content and news data used for summarization. While external access is expected for this skill's function, it still represents a genuine data egress path that could expose sensitive input if agents invoke it with broader context than intended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
API_BASE = "https://api.skillboss.co/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,