Multi Source Tech News Digest

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:43 AM UTC
• Version: 1.0.0

Overview

This appears to be a tech-news digest skill, but it includes unsafe generated-code subprocess fetching and an auto-start scheduled trigger with Telegram notifications that are not clearly disclosed in the main instructions.

Review carefully before installing. The skill should fetch news directly with safe HTTP/RSS libraries, validate or allowlist source URLs, remove generated python -c subprocess execution, clearly disclose or disable the auto-start cron and Telegram notification behavior by default, and pin dependencies with the correct package manager.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.py:49

Finding

Arbitrary Python Code Injection Through RSS Source URL

Content

View full analysis

Remediation

View remediation

List[Dict]: feed = feedparser.parse(source_url) return [ { "title": getattr(entry, "title", ""), "link": getattr(entry, "link", ""), "summary": getattr(entry, "summary", "")[:200], "published": getattr(entry, "published", ""), } for entry in feed.entries[:self.config["max_news_per_source"]] ] ``` Apply the following additional controls: 1. Parse URLs with `urllib.parse.urlparse()` and allow only `https`, or explicitly justified schemes. 2. If sources may be supplied by untrusted users, enforce an approved hostname allowlist. 3. Resolve destination addresses and reject loopback, private, link-local, multicast, and cloud metadata ranges to reduce SSRF exposure. 4. Enforce reasonable feed size, item-count, redirect, and network timeout limits. 5. Validate `max_news_per_source` as a bounded integer. 6. Add regression tests using quotes, semicolons, backslashes, newlines, and comment characters to verify that source values can never become executable code. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skill.py:72

Finding

Arbitrary Python Code Injection Through GitHub Repository URL

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill's behavior in a single fixed language, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill implicitly enforces one language without explicit opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's natural-language descriptions and user-visible output strings are written in Chinese, including the generated digest and status messages, with no indication that the user can choose another language. This creates a locale/language policy concern because the skill imposes a specific language without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill is configured to contact external GitHub API endpoints, which is expected for a news aggregation function but still constitutes outbound transmission. In this context the danger is limited because the destinations are hardcoded and no local sensitive data is explicitly sent, yet it remains relevant from a privacy and policy standpoint.

Content

Scanner excerpt · skill.py (reported line 31)May include surrounding context.

python

"https://www.zdnet.com/feed/"
            ],
            "github_repos": [
                "https://api.github.com/repos/trending",
                "https://api.github.com/repos/awesome"
            ],
            "web_sources": [

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This is a second hardcoded external GitHub endpoint used for outbound network access. As with the other endpoint, it is not inherently malicious, but undisclosed network transmission to third parties can still expose environment metadata and should be treated as a real security/privacy concern.

Content

Scanner excerpt · skill.py (reported line 32)May include surrounding context.

python

],
            "github_repos": [
                "https://api.github.com/repos/trending",
                "https://api.github.com/repos/awesome"
            ],
            "web_sources": [
                "https://news.google.com/search?q=technology",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill silently reaches out to multiple third-party services without any user-facing disclosure, consent flow, or clear runtime notice. While it does not transmit obvious local secrets from this file, undisclosed external communication can expose usage metadata and violates least-surprise expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A news-digest skill should only need network retrieval and parsing, but this implementation executes subprocesses to do that work. The mismatch between declared purpose and granted capability makes the skill more dangerous because any future tainted input could pivot into arbitrary code execution behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The skill spawns a Python subprocess and builds the executed code with an f-string that embeds the URL directly into the -c argument. Although the current URLs come from a hardcoded config, this introduces unnecessary code-execution capability for a simple news-fetching task and becomes dangerous if the source URL is ever made user-controlled or configurable.

Content

Scanner excerpt · skill.py (reported line 51)May include surrounding context.

python

try:
            # 使用OpenClaw的web_fetch工具获取内容
            import subprocess
            result = subprocess.run([
                sys.executable, "-c", 
                f"import requests; import feedparser; \
                feed = feedparser.parse('{source_url}'); \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The GitHub retrieval path duplicates the same unnecessary subprocess execution pattern, increasing attack surface and maintenance risk. In context, this is more suspicious because the skill's business logic does not justify a code-spawning mechanism just to fetch JSON.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This path also launches a Python subprocess with dynamically constructed code that embeds the repository URL into a -c string. That grants an avoidable execution primitive and broadens the skill's capabilities beyond its stated purpose, creating future command/code-injection risk if repository values become externally influenced.

Content

Scanner excerpt · skill.py (reported line 71)May include surrounding context.

python

releases = []
            for repo in self.config["github_repos"]:
                import subprocess
                result = subprocess.run([
                    sys.executable, "-c",
                    f"import requests; \
                    response = requests.get('{repo}', headers={{'Accept': 'application/vnd.github.v3+json'}}); \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file includes all user-facing comments and printed status messages in Chinese, which indicates a fixed language choice for the skill test flow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The configuration hard-codes the timezone to "Asia/Shanghai", which imposes a specific locale setting in the skill behavior. The file does not indicate that this locale is user-selectable or justified as a region-specific tool, so it may violate the policy against forcing a locale without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, so installations may resolve to different releases over time. That increases supply-chain risk because a newly published compromised or breaking version could be pulled without an explicit review, which matters for a skill that fetches and processes untrusted external content from many sources.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "OpenClaw Community",
  "license": "MIT",
  "dependencies": {
    "requests": "^2.31.0",
    "feedparser": "^6.0.11",
    "beautifulsoup4": "^4.12.3"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The package version is specified as a range rather than an exact version, allowing future installs to fetch different code than was originally tested. This creates a low-severity but real supply-chain exposure, especially in an aggregation skill that relies on network-facing parsers for external feeds.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "requests": "^2.31.0",
    "feedparser": "^6.0.11",
    "beautifulsoup4": "^4.12.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using an unpinned version for this dependency is more concerning because there is also a known advisory associated with the package name in the ecosystem. Without exact pinning, installs may resolve to an affected or malicious release, making the supply-chain risk materially higher than a generic unpinned package.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"dependencies": {
    "requests": "^2.31.0",
    "feedparser": "^6.0.11",
    "beautifulsoup4": "^4.12.3"
  }
}

Unverifiable Dependency: beautifulsoup4 has 1 known advisory(ies) (MAL-2025-3615 (Malicious code in beautifulsoup4 (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest references beautifulsoup4 without exact version pinning, while static analysis reports a known malicious-package advisory tied to that package name in npm. Because the installed release is not fixed, the project cannot demonstrate that consumers will avoid the affected version, creating a plausible supply-chain compromise path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower-bound version only, which allows future installs to resolve to different releases over time. This weakens build reproducibility and can inadvertently introduce vulnerable or incompatible versions through normal dependency resolution or supply-chain compromise.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

feedparser>=6.0.0
requests>=2.25.0
beautifulsoup4>=4.9.0

Unverifiable Dependency: feedparser has 10 known advisory(ies) (CVE-2011-1157 (feedparser Cross-site Scripting vulnerability); CVE-2009-5065 (feedparser Cross-site Scripting vulnerability); CVE-2011-1158 (feedparser Cross-site Scripting vulnerability) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

feedparser has known advisories, and because the manifest does not pin a specific version, there is no way to verify whether the installed release is affected. In this skill context, the risk is somewhat limited because this file only declares dependencies, but it still leaves open the possibility of deploying a vulnerable parser version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using requests>=2.25.0 permits installation of many possible versions, making it impossible to guarantee which release is deployed. This creates supply-chain and reproducibility risk, especially because requests has had multiple security advisories across versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

feedparser>=6.0.0
requests>=2.25.0
beautifulsoup4>=4.9.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

requests has multiple known advisories, and the broad version constraint prevents verifying whether installations will include a patched release. This is dangerous because requests is commonly used for network communication, so a vulnerable resolved version could affect confidentiality or request integrity depending on how the skill uses it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

An unpinned beautifulsoup4 dependency allows nondeterministic installs and makes security review of the final environment incomplete. While not proof of an immediately exploitable flaw, it is a real supply-chain hygiene issue that can expose the skill to vulnerable or breaking releases.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

feedparser>=6.0.0
requests>=2.25.0
beautifulsoup4>=4.9.0