ClawHub
Back to skill

Security audit

Noisepan Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for automated news digests, but it asks users to install mutable third-party binaries and set up persistent local automation with some weak safety controls.

Install only if you are comfortable reviewing shell commands first. Prefer Homebrew or pinned, verified releases; avoid writing to /usr/local/bin unless you explicitly want a system-wide install; bind any temporary HTTP server to 127.0.0.1; use private mktemp directories; and review or remove the ~/.local/bin helpers and cron jobs when no longer needed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding
Unpinned Remote Executables Installed from Mutable Third-Party Releases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-50 **Vulnerability Type**: Remote executable retrieval and supply-chain trust weakness **Risk Level**: High ### Vulnerable Code ```bash # noisepan VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt # Verify checksum grep linux_amd64 /tmp/noisepan-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/noisepan.tar.gz -C /usr/local/bin noisepan rm /tmp/noisepan.tar.gz /tmp/noisepan-checksums.txt # entropia VER=$(curl -s https://api.github.com/repos/ppiankov/entropia/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/entropia/releases/download/v${VER}/entropia_${VER}_linux_amd64.tar.gz" -o /tmp/entropia.tar.gz curl -fsSL "https://github.com/ppiankov/entropia/releases/download/v${VER}/checksums.txt" -o /tmp/entropia-checksums.txt # Verify checksum grep linux_amd64 /tmp/entropia-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/entropia.tar.gz -C /usr/local/bin entropia rm /tmp/entropia.tar.gz /tmp/entropia-checksums.txt ``` ### Technical Analysis The installation procedure dynamically queries the GitHub `releases/latest` endpoint and downloads precompiled executables selected by the resulting mutable version. The effective code executed by the Skill can therefore change after the Skill itself has been reviewed. Although checksum files are downloaded, both the executable archives and their expected checksums come from the same GitHub repository and release infrastructure. If the repository owner account, release workflow, signing environment, or GitHub release is compromised, an attacker can replace both the archive ...[truncated 1937 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin explicitly reviewed versions rather than resolving `releases/latest`. 2. Embed the expected SHA-256 digest for each supported artifact directly in the reviewed Skill release. 3. Prefer cryptographically signed release artifacts and verify signatures against a trusted public key obtained independently of the release being downloaded. 4. Abort installation if version resolution, download, digest validation, or signature validation fails. 5. Default to a user-local executable directory such as `~/.local/bin`; request explicit approval before writing to `/usr/local/bin`. 6. Download to a securely created temporary directory and inspect archive paths before extraction. 7. Consider directing users to build from a pinned source commit or use a reviewed package repository with provenance/attestation support. 8. Separate installation from normal Skill execution so that feed processing cannot silently update dependencies. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding
Checksum Verification Targets a Filename Different from the Downloaded Archive<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-46 **Vulnerability Type**: Fail-open and incorrectly implemented integrity validation **Risk Level**: Medium ### Vulnerable Code ```bash # noisepan VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt # Verify checksum grep linux_amd64 /tmp/noisepan-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/noisepan.tar.gz -C /usr/local/bin noisepan rm /tmp/noisepan.tar.gz /tmp/noisepan-checksums.txt # entropia VER=$(curl -s https://api.github.com/repos/ppiankov/entropia/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v) curl -fsSL "https://github.com/ppiankov/entropia/releases/download/v${VER}/entropia_${VER}_linux_amd64.tar.gz" -o /tmp/entropia.tar.gz curl -fsSL "https://github.com/ppiankov/entropia/releases/download/v${VER}/checksums.txt" -o /tmp/entropia-checksums.txt # Verify checksum grep linux_amd64 /tmp/entropia-checksums.txt | (cd /tmp && sha256sum -c) tar xzf /tmp/entropia.tar.gz -C /usr/local/bin entropia ``` ### Technical Analysis Each release archive is saved under a shortened local name, such as `/tmp/noisepan.tar.gz`, while an upstream checksum manifest would ordinarily identify the release artifact by its published name, such as `noisepan_${VER}_linux_amd64.tar.gz`. `sha256sum -c` attempts to open the filename recorded in the checksum line. Changing into `/tmp` does not reconcile that filename with the renamed archive. Unless the upstream manifest unexpectedly uses the shortened local filename, verification fails because the file named in the manifest is absent. The snippet does not enable `set -e` or explicitly test the validation command's exi ...[truncated 1469 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Preserve the original release filename when downloading: ```bash archive="noisepan_${VER}_linux_amd64.tar.gz" curl -fsSL "$url/$archive" -o "/tmp/$archive" grep " $archive$" /tmp/noisepan-checksums.txt | (cd /tmp && sha256sum -c -) ``` 2. Alternatively, extract the expected hash and explicitly compare it with `sha256sum` output for the actual local filename. 3. Begin installation scripts with `set -euo pipefail`. 4. Explicitly branch on validation failure and terminate before extraction. 5. Verify that exactly one checksum entry matches the intended operating system, architecture, and filename. 6. Use a secure temporary directory created by `mktemp -d` rather than fixed paths. 7. Add automated installation tests that confirm corrupted archives and mismatched filenames cannot reach the extraction step. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:126
Finding
Predictable Temporary Directories and Non-Loopback Temporary HTTP Server<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 126-152 **Vulnerability Type**: Unsafe temporary-file handling and unnecessary network exposure **Risk Level**: Medium ### Vulnerable Code ```bash cat > ~/.local/bin/noisepan-pull << 'SCRIPT' #!/bin/bash # Prefetch Reddit RSS sequentially to avoid rate limiting, then run noisepan pull CACHE_DIR="/tmp/reddit-rss-cache" CONFIG_DIR="${HOME}/.noisepan" UA="Mozilla/5.0 (compatible; noisepan/1.0)" mkdir -p "$CACHE_DIR" FEEDS=$(grep "reddit.com" "$CONFIG_DIR/config.yaml" | grep -v "^#" | grep -v "^ #" | sed 's/.*"\(.*\)"/\1/') for feed in $FEEDS; do sub=$(echo "$feed" | grep -oP '/r/\K[^/]+') curl -s -o "$CACHE_DIR/${sub}.xml" -H "User-Agent: $UA" "$feed" sleep 2 done python3 -m http.server 18222 --directory "$CACHE_DIR" &>/dev/null & HTTP_PID=$!; sleep 0.5 mkdir -p /tmp/noisepan-tmp cp "$CONFIG_DIR/config.yaml" /tmp/noisepan-tmp/config.yaml for feed in $FEEDS; do sub=$(echo "$feed" | grep -oP '/r/\K[^/]+') sed -i "s|$feed|http://localhost:18222/${sub}.xml|" /tmp/noisepan-tmp/config.yaml done ln -sf "$CONFIG_DIR/taste.yaml" /tmp/noisepan-tmp/taste.yaml ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db noisepan pull --config /tmp/noisepan-tmp "$@" kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp SCRIPT ``` ### Technical Analysis The wrapper uses fixed, globally predictable paths under `/tmp`: `/tmp/reddit-rss-cache` and `/tmp/noisepan-tmp`. On a multi-user system, another local user can pre-create or manipulate these locations before the wrapper runs. Because the code does not validate ownership, file type, or permissions, pre-existing directories, files, or symbolic-link arrangements can influence where content is written and what configuration is consumed. The cache server is started with `python3 -m http.server 18222` without `--bind 127.0.0.1`. Python's HTTP server normally listens on all available interfaces, even though the generated configur ...[truncated 2066 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Create a unique private workspace: ```bash WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/noisepan.XXXXXXXX") chmod 700 "$WORK_DIR" CACHE_DIR="$WORK_DIR/reddit-rss-cache" TEMP_CONFIG="$WORK_DIR/config" mkdir -m 700 "$CACHE_DIR" "$TEMP_CONFIG" ``` 2. Bind the temporary server exclusively to loopback: ```bash python3 -m http.server 18222 \ --bind 127.0.0.1 \ --directory "$CACHE_DIR" >/dev/null 2>&1 & ``` 3. Register cleanup immediately after creating resources: ```bash HTTP_PID="" cleanup() { if [ -n "$HTTP_PID" ]; then kill "$HTTP_PID" 2>/dev/null || true wait "$HTTP_PID" 2>/dev/null || true fi rm -rf -- "$WORK_DIR" } trap cleanup EXIT INT TERM ``` 4. Use a dynamically selected available loopback port rather than a fixed port where practical. 5. Validate temporary paths and reject symbolic links or objects not owned by the current user. 6. Apply restrictive permissions with `umask 077`. 7. Quote and safely parse feed values rather than iterating over shell word splitting. 8. Ensure server startup succeeded before rewriting the configuration and invoking `noisepan`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Verify checksum
grep linux_amd64 /tmp/noisepan-checksums.txt | (cd /tmp && sha256sum -c)
tar xzf /tmp/noisepan.tar.gz -C /usr/local/bin noisepan
rm /tmp/noisepan.tar.gz /tmp/noisepan-checksums.txt

# entropia
VER=$(curl -s https://api.github.com/repos/ppiankov/entropia/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Verify checksum
grep linux_amd64 /tmp/entropia-checksums.txt | (cd /tmp && sha256sum -c)
tar xzf /tmp/entropia.tar.gz -C /usr/local/bin entropia
rm /tmp/entropia.tar.gz /tmp/entropia-checksums.txt

# Verify both
noisepan version && entropia version
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db

noisepan pull --config /tmp/noisepan-tmp "$@"
kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp
SCRIPT
mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
```
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db

noisepan pull --config /tmp/noisepan-tmp "$@"
kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp
SCRIPT
mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
```
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
ln -sf "$CONFIG_DIR/noisepan.db" /tmp/noisepan-tmp/noisepan.db

noisepan pull --config /tmp/noisepan-tmp "$@"
kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp
SCRIPT
mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
```
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# noisepan
VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)
curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz
curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt
# Verify checksum
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# noisepan
VER=$(curl -s https://api.github.com/repos/ppiankov/noisepan/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)
curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/noisepan_${VER}_linux_amd64.tar.gz" -o /tmp/noisepan.tar.gz
curl -fsSL "https://github.com/ppiankov/noisepan/releases/download/v${VER}/checksums.txt" -o /tmp/noisepan-checksums.txt
# Verify checksum
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
## Reddit Rate Limiting

With 15+ Reddit feeds, parallel fetching triggers 429s. Create a sequential prefetch wrapper:

```bash
cat > ~/.local/bin/noisepan-pull << 'SCRIPT'
Confidence
94% confidence
Finding
The skill directs creation of a persistent executable wrapper under ~/.local/bin/noisepan-pull, which alters future user behavior and remains available beyond the immediate session. Persistent helper scripts are risky because they can be invoked later with inherited trust, especially when they perform network access, file rewrites, local serving, and cleanup operations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to create persistent local scripts, modify files under ~/.local/bin and ~/.noisepan, create symlinks, run a local HTTP server, write temporary files under /tmp, and configure cron automation, but it does not present a clear consolidated warning about these side effects. In a skill meant to be followed by an agent or user, this increases the chance of unreviewed system modifications and persistent automation being applied without informed consent.

Session Persistence

Medium
Category
Rogue Agent
Content
noisepan pull --config /tmp/noisepan-tmp "$@"
kill $HTTP_PID 2>/dev/null; rm -rf /tmp/noisepan-tmp
SCRIPT
mkdir -p ~/.local/bin && chmod +x ~/.local/bin/noisepan-pull
```

Use `noisepan-pull` instead of `noisepan pull` when you have 15+ Reddit feeds.
Confidence
88% confidence
Finding
Marking the created wrapper executable in ~/.local/bin finalizes persistence and makes the helper available on the user's PATH for repeated use. In the context of an agent skill, persistent PATH modifications are more dangerous because they can normalize execution of unreviewed local code in later sessions.

Static analysis

No suspicious patterns detected.