ClawHub
Back to skill

Security audit

每日新闻总结

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed news-digest generator that fetches public news and writes a report, with manageable caveats around one HTTP feed and optional recurring automation.

Install this if you want a Chinese daily news report generated from public sources. Review or replace the HTTP BBC feed with HTTPS if possible, treat fetched article text as untrusted, and only request recurring automation when you are comfortable with ongoing scheduled web fetching and file creation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

News Feed Retrieved over Unencrypted HTTP

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31 and references/news_sources.md:7
Vulnerability Type: Unencrypted external content retrieval
Risk Level: Medium

Vulnerable Code

SKILL.md:31:

markdown
- http://feeds.bbci.co.uk/news/world/rss.xml （BBC国际新闻官方RSS）

references/news_sources.md:7:

markdown
| BBC国际新闻 | http://feeds.bbci.co.uk/news/world/rss.xml | RSS | 国际 | ⭐⭐⭐ | 最稳定国际RSS |

Technical Analysis

The Skill instructs the Agent to retrieve a BBC RSS feed through plaintext HTTP. HTTP provides neither transport confidentiality nor cryptographic integrity. An attacker capable of intercepting or altering the network connection could modify the response before it reaches the Agent.

Although the request does not contain credentials or private user information, the retrieved response becomes an input to an AI Agent. Modified RSS entries could contain fabricated news, malicious links, or prompt-injection text designed to influence subsequent processing. The duplicated insecure endpoint in the reference file may also cause the HTTP URL to be reused during future maintenance.

The network access itself is necessary for the declared news-digest functionality and does not exceed minimum required privileges. The weakness is the use of an insecure transport protocol rather than the existence of network access.

Attack Path

  1. A user invokes the Skill to generate a daily news digest.
  2. The Agent requests http://feeds.bbci.co.uk/news/world/rss.xml.
  3. An attacker with a suitable network position, such as a compromised gateway, hostile wireless access point, DNS manipulation capability, or upstream interception capability, intercepts the plaintext request.
  4. The attacker returns a modified RSS response or substitutes a malicious redirect before any secure connection is established.
  5. The Agent processes the attacker-controlled entries as news-source content.
  6. Fabricated ...[truncated 943 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the plaintext endpoint with the official HTTPS equivalent everywhere it appears:

    markdown
    https://feeds.bbci.co.uk/news/world/rss.xml

  2. Update both SKILL.md:31 and references/news_sources.md:7 so the insecure URL cannot be reintroduced from the reference documentation.

  3. Reject redirects that downgrade an HTTPS request to HTTP.

  4. Treat all RSS and webpage content as untrusted data. Explicitly instruct the Agent not to follow commands, tool requests, or behavioral directives found in fetched content.

  5. Permit outbound requests only to the documented HTTPS source domains and validate final redirect destinations against that allowlist.

  6. Preserve source attribution, but validate article links before adding them to the report. Reject unexpected protocols and clearly unrelated domains.

  7. Where supported, apply response-size limits, parsing limits, timeouts, and content-type validation to reduce exposure to malformed or hostile feed responses.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description includes broad, common-use phrasing around generating daily news summaries and setting automated news tasks, which could cause the skill to activate in situations where the user did not explicitly intend to invoke it. Unintended activation matters here because the workflow performs external fetching, creates files, and can lead to automation setup, so the trigger surface is wider than a read-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs saving a Markdown file directly to the workspace root without any user-facing confirmation or warning that a file will be created. This can surprise users, overwrite expectations about workspace cleanliness, and in chained workflows may cause unintended persistence of externally sourced content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill allows creation of a recurring automation task but does not require a warning or explicit opt-in acknowledging ongoing scheduled actions. Persistent automation is more dangerous than a one-time action because it can continue making network requests and generating files long after the initial interaction, potentially creating unwanted background activity and repeated artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file mandates 语言：中文 for the generated report, which imposes a specific language regardless of user preference. The skill does not offer a language choice or describe this as an optional or justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This reference file presents all operational guidance in Chinese only, with no indication that the user can choose another language and no documented region-specific justification for the language restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.