ClawHub
Back to skill

Security audit

新闻skill

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches daily news from a disclosed third-party API and does not show hidden local access, persistence, credential use, or destructive behavior.

Before installing, understand that news queries will contact api.cjiot.cc, so that service can observe requested dates and article IDs. Returned news content should be treated as third-party content, and the skill would be clearer if it narrowed its trigger terms and documented its Chinese-language focus.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
代码与“每日新闻获取/按日期查询/摘要展示”这一核心描述基本一致：它会接受日期参数、调用 API 拉取每日新闻并展示摘要列表。但声明中提到的“新闻详情阅读”并未在本代码块内实现，代码只是打印 article_id 并提示用 get-article.js 查看详情；因此该能力与当前提供的代码不符。此外，“热点新闻排行”若理解为独立能力，当前实现只是对当天返回的文章按热度排序展示，功能范围比声明更窄。未发现越权访问、本地敏感资源访问或与新闻无关的隐藏行为。

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
描述文本与整份说明均默认以中文进行交互和输出，但未说明这是用户可选项，也未声明该技能仅面向特定中文使用场景。根据语言/locale 政策，强制单一语言而无用户选择可能构成自然语言策略违规。

External Transmission

Medium
Category
Data Exfiltration
Content
**接口地址：**
```
https://api.cjiot.cc/api/v1/daily?date={YYYY-MM-DD}
```

**参数说明：**
Confidence
84% confidence
Finding
The skill sends user-derived query data, specifically requested dates, to an external third-party API. While the transmitted data is low sensitivity in normal use, outbound requests still disclose user activity and create a dependency on an untrusted remote service that could log requests, return misleading content, or change behavior unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
**接口地址：**
```
https://api.cjiot.cc/api/v1/articles/{article_id}
```

**参数说明：**
Confidence
86% confidence
Finding
Fetching article details from a third-party endpoint transmits an article identifier derived from prior interaction and exposes the conversation's reading choices to the remote service. Although this is not highly sensitive by itself, it is still external transmission to an untrusted domain and extends trust to remote content that may be inaccurate or maliciously formatted.

Vague Triggers

Medium
Confidence
95% confidence
Finding
该段将触发条件定义为包含“新闻”“日报”“日知录”“头条”等关键词即可，范围过大，容易与普通对话中的泛化表达重叠。文档也没有提供排除条件或负例，难以界定技能何时不应触发。

External Transmission

Medium
Category
Data Exfiltration
Content
**处理步骤：**
1. 获取当前日期（格式：YYYY-MM-DD）
2. 调用 API：`curl -s "https://api.cjiot.cc/api/v1/daily?date={当前日期}"`
3. 解析返回的新闻列表
4. 按热度排序展示前 10 条新闻摘要
Confidence
84% confidence
Finding
This instruction operationalizes direct network access via curl to a third-party service, which creates a real external transmission path. In the context of a news skill the payload is low-risk, but the mechanism could still leak usage patterns, enable tracking, and normalize unaudited outbound connections from the agent environment.

External Transmission

Medium
Category
Data Exfiltration
Content
**处理步骤：**
1. 解析用户输入的日期
2. 调用 API：`curl -s "https://api.cjiot.cc/api/v1/daily?date={日期}"`
3. 解析并展示新闻列表

**回复模板：**
Confidence
84% confidence
Finding
The skill instructs transmitting user-specified dates to an external API, which is a genuine data egress pattern. The context makes it less dangerous than a skill handling secrets, but it still involves third-party observability of user requests and reliance on remote responses without any stated trust boundary controls.

External Transmission

Medium
Category
Data Exfiltration
Content
**处理步骤：**
1. 从上下文获取当前新闻列表
2. 提取用户指定的文章 ID
3. 调用 API：`curl -s "https://api.cjiot.cc/api/v1/articles/{article_id}"`
4. 解析并展示新闻详情（标题、分类、热度、正文）

**回复模板：**
Confidence
87% confidence
Finding
This step combines external transmission with remote content retrieval and display. Because article content may include HTML and is sourced from an untrusted external service, there is some additional risk of rendering unsafe or deceptive content if downstream consumers do not sanitize it properly.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
This code file contains natural-language strings that force a specific language for usage instructions and user feedback. Under the policy, locale-specific language is a violation unless the skill offers opt-in or clearly documents a justified regional constraint, which is not present here.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The file’s docstring and all user-facing messages are written exclusively in Chinese, which imposes a specific language on users without opt-in. Under the language/locale policy, this is a natural-language policy violation unless the locale restriction is explicitly justified or users are given a choice.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
  }

  const url = `https://api.cjiot.cc/api/v1/daily?date=${date}`;

  https.get(url, (res) => {
    let data = '';
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
  }

  const url = `https://api.cjiot.cc/api/v1/daily?date=${date}`;

  https.get(url, (res) => {
    let data = '';
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.