ClawHub
Back to skill

Security audit

ETH24

Security checks for vulnerabilities and agentic risk

Overview

ETH24 is a coherent daily social-media digest skill whose network calls, local outputs, and optional Typefully draft creation match its stated purpose, though users should understand the external services and review generated drafts.

Install and run this only in an environment where outbound calls to X, xAI, Anthropic, RSS feeds, and Typefully are acceptable. Review any Typefully draft before publishing, and prefer pinned dependency versions or a virtual environment if reproducibility matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
rank.py:72
Finding

Indirect Prompt Injection Through Untrusted Tweet and RSS Content

Content
View full analysis
Remediation
View remediation
/status/` URLs. - Remove control characters and unexpected markup. 5. **Require review before external submission** - Preserve the existing draft-only behavior. - Present a clear diff or source comparison before creating the Typefully draft. - Consider requiring an explicit confirmation flag before any network submission to Typefully. 6. **Add adversarial tests** - Test tweets and RSS summaries containing phrases such as “ignore previous instructions.” - Verify that injected URLs, extra stories, modified handles, and oversized fields are rejected deterministically. ]]>

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Mutable Third-Party Installation Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)

Tainted flow: 'api_key' from os.environ.get (line 52, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · crawl.py (reported line 77)May include surrounding context.

python
}

    try:
        resp = httpx.post(
            "https://api.x.ai/v1/responses",
            headers={
                "Authorization": f"Bearer {api_key}",

Tainted flow: 'social_set_id' from os.environ.get (line 133, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · publish.py (reported line 36)May include surrounding context.

python
filename = Path(image_path).name

    # Request upload slot
    resp = httpx.post(
        f"{TYPEFULLY_BASE}/v2/social-sets/{social_set_id}/media/upload",
        headers=headers,
        json={"file_name": filename},

Tainted flow: 'social_set_id' from os.environ.get (line 133, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · publish.py (reported line 62)May include surrounding context.

python
def create_draft(social_set_id, posts):
    """Create a draft on Typefully and return the API response."""
    resp = httpx.post(
        f"{TYPEFULLY_BASE}/v2/social-sets/{social_set_id}/drafts",
        headers=_headers(),
        json={

Tainted flow: 'api_key' from os.environ.get (line 45, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · rank.py (reported line 22)May include surrounding context.

python
api_key = os.environ.get("ANTHROPIC_API_KEY")
    if not api_key:
        return None
    resp = httpx.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,

Tainted flow: 'api_key' from os.environ.get (line 45, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · rank.py (reported line 48)May include surrounding context.

python
api_key = os.environ.get("XAI_API_KEY")
    if not api_key:
        return None
    resp = httpx.post(
        "https://api.x.ai/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub@latest install eth24, which fetches and executes the latest package version at install time. Because the version is not pinned, a compromised upstream package, malicious update, or dependency confusion event could cause arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level docstring states the file 'Crawl[s] Ethereum tweets via hybrid discovery,' which describes only tweet crawling. However, the implementation also retrieves RSS feed content in crawl_rss() and persists both tweets and RSS data to output/crawled.json, so the documentation understates and mischaracterizes the skill's actual behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · crawl.py (reported line 18)May include surrounding context.

python
SCRIPT_DIR = Path(__file__).parent
CONFIG = json.loads((SCRIPT_DIR / "config.json").read_text())

X_API_BASE = "https://api.x.com/2"


# ---------------------------------------------------------------------------

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The query builder appends lang:en, which restricts results to English-language tweets by default. This is a natural-language policy concern because the skill forces a specific language/locale choice without offering configuration or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest defines very generic trigger phrases such as "daily digest," "top tweets," and "daily briefing," which could match unrelated user requests and cause this skill to activate unexpectedly. In an agent ecosystem, overly broad invocation phrases can hijack routing away from more appropriate skills and may lead to unnecessary network activity or untrusted content retrieval without clear user intent.

Content

No source excerpt is available for this finding.

Tainted flow: 'slot' from httpx.post (line 43, network input) → httpx.put (network output)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The code takes upload_url from a network response and immediately performs an unauthenticated PUT of local file contents to that URL without validating the host or scheme. If the upstream response is compromised, misrouted, or malicious, this becomes a server-side request forgery/data exfiltration primitive that can send arbitrary local file content to an attacker-controlled endpoint.

Content

Scanner excerpt · publish.py (reported line 48)May include surrounding context.

python
# PUT binary to presigned URL
    with open(image_path, "rb") as f:
        httpx.put(
            slot["upload_url"],
            content=f.read(),
            timeout=60,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · crawl.py (reported line 77)May include surrounding context.

python
api_key = os.environ.get("ANTHROPIC_API_KEY")
    if not api_key:
        return None
    resp = httpx.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rank.py (reported line 22)May include surrounding context.

python
api_key = os.environ.get("ANTHROPIC_API_KEY")
    if not api_key:
        return None
    resp = httpx.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rank.py (reported line 48)May include surrounding context.

python
api_key = os.environ.get("ANTHROPIC_API_KEY")
    if not api_key:
        return None
    resp = httpx.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function sends tweet text, handles, URLs, engagement metrics, and RSS-derived content to Anthropic without any consent gate, redaction step, or prominent disclosure beyond a stderr progress message. In a skill context, this can unintentionally transmit third-party or sensitive input data to an external processor, creating privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rank.py (reported line 23)May include surrounding context.

python
if not api_key:
        return None
    resp = httpx.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
            "anthropic-version": "2023-06-01",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The same unannounced data-sharing issue exists for xAI: collected tweet and RSS content is forwarded to a third-party model API without a clear warning or consent mechanism. Even if the source data is often public, bundling and transmitting it externally may violate operator expectations or policy requirements, especially if feeds can contain non-public or licensed content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · crawl.py (reported line 78)May include surrounding context.

python
if not api_key:
        return None
    resp = httpx.post(
        "https://api.x.ai/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rank.py (reported line 49)May include surrounding context.

python
if not api_key:
        return None
    resp = httpx.post(
        "https://api.x.ai/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file explains that each run writes multiple artifacts under output/YYYY-MM-DD/, including crawled.json with raw tweet data and derived output files. While file output is part of the skill's behavior, there is no explicit warning or note that running the skill persists collected data locally, which may matter for user expectations around storage and cleanup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to fetch data from external services and write results into local output files, but it does not warn the user about these side effects. This is dangerous because users may unknowingly trigger network access and filesystem writes, which can create privacy, operational, or compliance issues in restricted environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script creates an output directory and writes a JSON file containing collected tweet and RSS data, but there is no prior warning, confirmation, or explanatory comment/docstring near the write operation. For a code file, file writes should have some visible disclosure unless clearly covered elsewhere; here the save only becomes apparent at execution time.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency 'feedparser' is unpinned, which makes builds non-reproducible and can silently introduce vulnerable or incompatible versions over time. In a supply-chain context, this weakens reviewability and makes it impossible to verify whether a safe version is consistently installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
feedparser
Pillow
httpx

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest references 'feedparser' without a version even though the package has multiple known advisories in its history. Because no version is specified, it is impossible to determine from this file whether deployment will use a fixed release or one affected by historical vulnerabilities.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency 'Pillow' is unpinned, so installations may resolve to different versions across environments or over time. Because Pillow has had multiple security issues historically, leaving it unpinned increases the chance of unintentionally pulling an affected release.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
feedparser
Pillow
httpx