ClawHub

Hacker News Poster

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it uses your Hacker News credentials to post or edit content, with a disclosed but sensitive plaintext cookie file risk.

Install only if you are comfortable giving an agent access to your Hacker News account. Review the exact title, URL, comment text, item ID, or profile bio before running posting commands. Prefer the reviewed ClawHub install over the raw GitHub curl option, and delete or restrict access to ~/.hn_cookies.txt when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly relies on environment variables for credentials and performs authenticated network actions, but it does not declare corresponding permissions. Undeclared access to env and network weakens security review and least-privilege controls, especially because the skill can post content and persists plaintext session cookies, increasing the sensitivity of those capabilities.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README directs users to place Hacker News credentials in environment variables but provides no warning about secure handling, scoping, or leakage risks. In agent and CLI environments, environment variables are often exposed through process listings, logs, crash reports, child processes, or debugging output, which can lead to account compromise if the credentials are reused or harvested.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script persists authenticated session cookies to a predictable local file in the user's home directory, which creates a reusable bearer-token artifact on disk. If the file is read by another local user, included in backups, or stored with weak permissions, an attacker may be able to hijack the Hacker News session without knowing the password.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal