a skill for Chinese users access RSS subscription aggregation through the openclaw on cloud services, enabling them to view RSS feeds recommended by Andrej Karpathy.

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 1.0.0

Overview

This RSS setup skill is mostly a coherent guide, but it asks users to install unpinned external software and another skill by bare name, which leaves too much supply-chain ambiguity.

Install only after reviewing the resolved `feed` source, choosing a pinned version or commit, and verifying exactly which `rss-digest` skill, publisher, version, and permissions will be installed. Run setup on a non-sensitive machine or container where possible, and review the OPML list because aggregation will contact many third-party sites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Executable Dependency Installed Through a Third-Party Module Proxy

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-22; duplicated in README.md:47-53
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

# Update apt
sudo apt update
# Install Go
sudo apt install golang-go
# Set Chinese mirror
export GOPROXY=https://goproxy.cn,direct
# Install feed
go install github.com/odysseus0/feed/cmd/feed@latest

Technical Analysis

The installation command uses the mutable @latest selector rather than a reviewed, immutable release or commit. Consequently, the source code installed when a user follows these instructions can change after the Skill itself has been audited.

The command also configures goproxy.cn as the primary Go module proxy. Although Go module checksums may provide some ecosystem-level integrity protection, the Skill does not document an expected version, commit, module checksum, trusted release signature, or independent verification procedure. The reviewed project therefore cannot establish which executable will ultimately be installed.

This is a supply-chain vulnerability rather than evidence that the current upstream project or proxy is malicious.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, the release process, or another relevant dependency-delivery component.
2. The attacker publishes a malicious revision that is selected by @latest.
3. A user follows the Skill and runs the documented go install command.
4. Go retrieves and compiles the newly selected code.
5. The resulting binary is installed under the user's account.
6. When the user or Agent invokes that binary, attacker-controlled code executes with the invoking user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account that runs the installed feed binary. This may permit access to files, e ...[truncated 400 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, immutable version or commit, such as an explicitly approved semantic version.
• Record and verify the expected module checksum or signed release artifact.
• Review the selected release and its dependency graph before recommending installation.
• Prefer an official and trusted Go module source. If a regional proxy is required, document its trust assumptions and verification procedure.
• Run installation and subsequent execution as an unprivileged user.
• Consider building in an isolated environment and distributing a verified artifact with a published cryptographic digest.
• Add an update process requiring explicit review before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unverified External Skill Installed by Bare Name

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-30; duplicated in README.md:56-64
Vulnerability Type: Unverified Skill dependency
Risk Level: Medium

Vulnerable Code

text

`rss-digest`

The surrounding instructions direct the user to install the Skill identified only by this bare name.

Technical Analysis

The project does not specify a canonical registry, publisher identity, source repository, immutable version, cryptographic digest, or required permissions for the external rss-digest Skill. Resolution by name alone creates ambiguity about which package will be installed.

The unresolved dependency is subsequently entrusted with importing OPML data, fetching remote feeds, and aggregating their content. If name resolution selects a malicious or compromised Skill, its instructions or executable components could operate with the tools and permissions granted by the Agent environment.

No evidence establishes that the current rss-digest Skill is malicious. The issue is the absence of identity, version, integrity, and permission controls.

Attack Path

1. An attacker publishes a Skill with the same or confusingly similar name in a registry searched by the Agent, or compromises the legitimate package or registry entry.
2. The user asks the Agent to install rss-digest without a canonical publisher or immutable version.
3. The installation mechanism resolves the bare name to the attacker-controlled package.
4. The Agent loads or executes the substituted Skill.
5. During OPML import or feed aggregation, malicious instructions or code use whatever filesystem, network, command-execution, or other capabilities were granted to the Skill.

Impact Assessment

The maximum impact depends on the external Skill installation model and the permissions granted by OpenClaw. A malicious resolved package could potentially alter Agent behavior or access files, network services, environment variables ...[truncated 246 chars]

Remediation

View remediation

Remediation Suggestions

• Identify the dependency using a canonical registry, verified publisher, and exact package identifier.
• Pin an immutable reviewed version and publish its expected cryptographic digest.
• Link to the authoritative source repository and document how users can verify publisher ownership.
• Review the dependency's Skill instructions, scripts, transitive dependencies, and requested permissions before installation.
• Require explicit user confirmation showing the resolved publisher, version, source, digest, and permissions.
• Apply least privilege by denying command execution, sensitive filesystem access, credential access, and unrestricted networking unless specifically required.
• Re-audit the external Skill before approving version updates.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:51

Finding

RSS Feeds Retrieved over Unauthenticated Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51 and SKILL.md:91
Vulnerability Type: Insecure plaintext transport
Risk Level: Low

Vulnerable Code

xml

<outline type="rss" text="antirez.com" title="antirez.com"
         xmlUrl="http://antirez.com/rss"
         htmlUrl="http://antirez.com"/>

<outline type="rss" text="paulgraham.com" title="paulgraham.com"
         xmlUrl="http://www.aaronsw.com/2002/feeds/pgessays.rss"
         htmlUrl="https://paulgraham.com"/>

Technical Analysis

The two xmlUrl values use plaintext HTTP. HTTP does not authenticate the server or protect feed data against modification in transit. An attacker able to observe or modify the relevant network traffic can replace feed metadata, article text, or links before the aggregation component processes them.

This primarily threatens the integrity and authenticity of aggregated content. If the downstream rss-digest implementation passes feed text to an Agent without clearly separating untrusted content from instructions, modified entries could also act as an indirect prompt-injection input. That secondary consequence is conditional because the external Skill's implementation is not included in the audited project.

Attack Path

1. The aggregation component requests one of the listed feed URLs over HTTP.
2. An attacker with an on-path position intercepts the request or response.
3. The attacker substitutes a forged RSS response containing false content, malicious links, or instruction-like text.
4. The aggregation component accepts the response because HTTP provides no transport authentication.
5. The forged content is displayed to the user or processed by the Agent.
6. If downstream processing incorrectly treats feed content as trusted instructions, the attacker may influence Agent actions within the downstream component's available permissions.

Impact Assessment

A successful attack can falsify aggr ...[truncated 386 chars]

Remediation

View remediation

Remediation Suggestions

• Replace both HTTP feed URLs with verified HTTPS endpoints supplied by the respective publishers.
• Remove a feed if no authentic HTTPS endpoint is available, or retrieve it through a trusted service that validates the upstream source.
• Reject redirects that downgrade from HTTPS to HTTP.
• Treat all feed titles, descriptions, article bodies, links, and metadata as untrusted data.
• Ensure downstream Agent processing clearly delimits feed content and never interprets it as privileged instructions.
• Sanitize rendered feed content and validate outbound links before presenting or following them.
• Apply request timeouts, response-size limits, content-type validation, and safe XML parsing in the aggregation component.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to run system-changing commands, including package installation and Go-based software installation, without an explicit warning that these commands modify the host system and may install unreviewed software from the network. While common in setup guides, this creates real risk in an agent skill context because users may execute the steps with elevated trust and without understanding the consequences.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly tells the user to run 'sudo apt update', which invokes privileged execution. In a documentation-only context this is often normal, but in an agent skill it is still security-relevant because it normalizes root-level command execution and could be followed automatically or semi-automatically without adequate scrutiny.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

bash

# Update apt
sudo apt update
# Install Go
sudo apt install golang-go
# Set Chinese mirror

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The command 'sudo apt install golang-go' performs privileged package installation, altering the system state as root. This is not overtly malicious, but it is dangerous in an agent-delivered skill because it encourages elevated execution and can expand risk if the environment, package sources, or subsequent instructions are compromised.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md

# Update apt
sudo apt update
# Install Go
sudo apt install golang-go
# Set Chinese mirror
export GOPROXY=https://goproxy.cn,direct
# Install feed

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

md

- Linux operating system with apt package manager
- 带有apt包管理器的Linux操作系统
- sudo privileges to install dependencies
- 安装依赖所需的sudo权限
- Internet connection in China
- 中国境内的互联网连接

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and all user-facing instructions are written exclusively in Chinese, and the usage notes require operation in a China-specific environment, but the file does not offer the user a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific; this document does not explicitly justify Chinese-only output as a required constraint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill directs users to run package-management commands with sudo, which elevates privileges and modifies the host system. Although common for software installation, privileged execution increases risk if users blindly follow instructions on sensitive systems or if upstream packages/mirrors are compromised.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash

# 更新apt
sudo apt update
# 安装golang
sudo apt install golang-go
# 添加中国镜像

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This finding corresponds to another explicit sudo-based installation step, again requiring elevated privileges on the host. Repeated root-level instructions compound the chance of accidental system-wide changes or damage if copied into the wrong environment.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

# 更新apt
sudo apt update
# 安装golang
sudo apt install golang-go
# 添加中国镜像
export GOPROXY=https://goproxy.cn,direct
# 安装feed

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to install tooling and import a very large OPML feed list without warning that this will trigger connections to many third-party domains. Those requests can reveal IP address, timing, user agent, and reading-interest metadata, which is a real privacy and operational-risk issue, especially in restricted or monitored network environments.

Content

No source excerpt is available for this finding.