ClawHub
Back to skill

Security audit

HN Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill is a read-only Hacker News helper with dependency and output-sanitization risks, but no hidden credential access, persistence, or destructive behavior was found.

Reasonable to install only if you accept a small public-network CLI skill, but update and pin dependencies before use, narrow activation phrases to HN-specific wording, and sanitize Hacker News text before printing it in terminals.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
src/index.js:49
Finding

Terminal Escape-Sequence Injection Through Untrusted Hacker News Content

Content
View full analysis
]*>/g, '')}`); } ``` ### Technical Analysis The application retrieves public, user-generated Hacker News data and writes fields such as `story.title`, `story.by`, `story.text`, `user.id`, and `user.about` directly to the terminal. The regular expression applied to `story.text` removes strings resembling HTML tags, but it does not remove terminal control characters or ANSI escape sequences. HTML stripping and terminal-output sanitization address different encoding contexts. If attacker-controlled content contains supported control sequences, a compatible terminal may interpret those bytes instead of displaying them literally. Relevant sequence classes include: - ANSI/CSI sequences that change colors, cursor ...[truncated 1898 chars]
Remediation
View remediation
]*>/g, ''), { allowNewlines: true } ); ``` The sanitizer should be validated against the terminal environments sup ...[truncated 90 chars]

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins axios 1.13.6, and the supplied advisory set includes high-risk issues such as SSRF-related proxy bypass and prototype-pollution-enabled request/response manipulation. Because axios is the primary direct dependency in this skill, any code using it for outbound HTTP requests could inherit those weaknesses, making this a genuine supply-chain risk rather than a contextual false positive.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
90% confidence
Finding

The presence of form-data 4.0.5 introduces a reported CRLF injection risk in multipart field names and filenames. If any part of the skill constructs multipart requests from user-controlled input, an attacker may be able to smuggle additional headers or manipulate downstream HTTP parsing, which can lead to request tampering or data exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

The project permits installation of axios versions that static analysis associates with multiple published advisories, including SSRF/proxy-bypass and prototype-pollution-related issues. In a skill that monitors and searches HackerNews via external API calls, a vulnerable HTTP client is materially relevant because it processes untrusted network input and outbound request configuration, increasing the chance of request tampering, credential leakage, or response hijacking if exploitable code paths are present.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes very generic terms like "new", "latest", "jobs", and "best" without requiring HackerNews-specific context. In an agent environment, these phrases can cause unintended skill activation during unrelated user requests, leading to confused-deputy behavior or incorrect external API access when the user did not intend to invoke this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code hard-codes the locale 'pt-BR' for date formatting, and the surrounding CLI messages are also written in Portuguese. This imposes a specific language/locale on all users without offering opt-in, selection, or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Natural-language instructions and trigger descriptions are presented only in Portuguese, but there is no statement that the skill is intended specifically for Portuguese-speaking users or that other languages are supported. This can conflict with organizational language-choice expectations when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The lockfile includes follow-redirects 1.15.11, which is reported to leak custom authentication headers across cross-domain redirects. Even though the scanner labels the advisory LOW, in an agent or integration context this can expose API keys, bearer tokens, or internal auth headers to attacker-controlled redirect targets, raising practical risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range (^1.6.0), which allows automatic installation of newer 1.x releases rather than a single reviewed version. This weakens supply-chain control and can unexpectedly introduce vulnerable or malicious upstream changes, especially because the separate finding indicates resolution may reach a vulnerable axios release.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"start": "node src/index.js"
  },
  "dependencies": {
    "axios": "^1.6.0"
  }
}