Hacker News Poster

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:37 PM UTC
• Version: 1.0.5

Overview

This skill appears to do what it claims, but it handles Hacker News credentials and session cookies and includes a risky unpinned script-download path.

Review before installing. Use this only with an account you are comfortable posting from through an agent, avoid putting the password on the command line, protect or delete the cookie file after use, and prefer the packaged ClawHub install over the README's raw GitHub curl command unless the downloaded script is pinned and verified.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:12
• Finding: Mutable Remote Script Download Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md:12` **Vulnerability Type**: Unverified remote payload retrieval **Risk Level**: High ### Vulnerable Code ```bash curl -O https://raw.githubusercontent.com/frostai-lab/hacker-news-poster/main/scripts/hn.py ``` ### Technical Analysis The documented installation method downloads executable Python code from the mutable `main` branch of a personal GitHub repository. It does not pin a reviewed commit, verify a cryptographic checksum, or validate a signature. Although the command does not immediately execute the downloaded file, the project instructions subsequently direct users to run `hn.py`. The effective executable can therefore change after the Skill has been audited. HTTPS protects the connection in transit but does not protect against compromise of the repository, maintainer account, or upstream content. ### Attack Path 1. An attacker compromises the upstream repository or its maintainer account. 2. The attacker replaces `scripts/hn.py` on the `main` branch with malicious code. 3. A user follows the README and downloads the modified script. 4. The user executes the script as instructed while HN credentials are available. 5. The substituted script executes with the user's local privileges and may read credentials, steal session cookies, alter files, or perform other actions available to that user. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the script. Since the script is intended to run with `HN_USERNAME` and `HN_PASSWORD` in its environment and access to an authenticated cookie file, an attacker could compromise the user's Hacker News account. The attacker could also access other files and resources available to the local user. No evidence was found that the currently bundled `scripts/hn.py` contains such a payload; the risk arises from the mutable, unverified installation channel. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer distributing and invoking the script bundled in the reviewed Skill package. - If direct download remains supported, pin the URL to an immutable Git commit rather than `main`. - Publish a SHA-256 digest through a separately protected release channel and require users to verify it before execution. - Prefer signed releases or signed commits with documented signature-verification steps. - Avoid instructions that download and execute mutable code under an environment containing account credentials. - Establish release automation that verifies the published artifact matches the reviewed source. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hn.py:14
• Finding: Session Cookies Persisted Without Explicit Owner-Only Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hn.py:14-27` **Vulnerability Type**: Insecure plaintext session-token storage **Risk Level**: Medium ### Vulnerable Code ```python COOKIE_FILE = os.environ.get("HN_COOKIE_FILE", os.path.expanduser("~/.hn_cookies.txt")) BASE = "https://news.ycombinator.com" def get_opener(): jar = http.cookiejar.MozillaCookieJar(COOKIE_FILE) if os.path.exists(COOKIE_FILE): jar.load(ignore_discard=True, ignore_expires=True) opener = urllib.request.build_opener( urllib.request.HTTPCookieProcessor(jar), urllib.request.HTTPRedirectHandler() ) opener.addheaders = [("User-Agent", "Mozilla/5.0")] return opener, jar def save_cookies(jar): jar.save(ignore_discard=True, ignore_expires=True) ``` ### Technical Analysis The script deliberately persists authenticated Hacker News cookies in a plaintext Mozilla cookie jar. This persistence is declared by the Skill, but the implementation does not explicitly enforce owner-only permissions such as mode `0600`. The resulting permissions depend on the process umask and, for an existing cookie file, its pre-existing mode. On a system with permissive settings, another local account or process may be able to read the session token. Ignoring cookie expiration while loading also causes expired cookies to be loaded from disk, although the remote service remains responsible for deciding whether they are valid. Cookie persistence is useful for the declared functionality because it avoids repeated authentication, but unrestricted plaintext storage exceeds the minimum exposure necessary. ### Attack Path 1. The user authenticates through the Skill. 2. The authenticated session cookie is written to `HN_COOKIE_FILE`. 3. The cookie file is created or retained with permissions that permit another local principal to read it. 4. The attacker copies the Hacker News session token. 5. The attacker injects the token into their own HTTP client and ...[truncated 610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the cookie file with owner-only mode `0600`. - Apply `os.chmod(COOKIE_FILE, 0o600)` after every save and verify the result. - Reject or warn about existing cookie files that are not regular files or have group/world permissions. - Create parent directories with restrictive permissions and avoid following attacker-controlled symbolic links where feasible. - Consider storing session tokens in an operating-system credential store instead of a plaintext file. - Provide an option to disable cookie persistence for one-shot or shared-host executions. - Continue documenting that deleting the cookie file terminates local session persistence, and advise users to invalidate the remote session if theft is suspected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hn.py:143
• Finding: Password Accepted Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hn.py:143-144` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python login.add_argument("--username", "-u") login.add_argument("--password", "-p") ``` The login handler consumes the argument as follows: ```python username = args.username or os.environ.get("HN_USERNAME") password = args.password or os.environ.get("HN_PASSWORD") ``` ### Technical Analysis Accepting a secret through `--password` or `-p` places it in the process argument vector. Depending on the operating system and host configuration, command-line arguments may be exposed through process inspection facilities, monitoring agents, audit logs, debugging output, shell history, terminal transcripts, or AI-agent execution logs. The README recommends environment variables, but the exposed command-line interface remains available. Environment variables also require careful handling, but they ordinarily avoid shell-history and argument-vector disclosure. An interactive hidden prompt or a dedicated secret provider would further reduce exposure. ### Attack Path 1. A user invokes the login command with `--password <secret>` or `-p <secret>`. 2. The complete command is recorded in shell history, execution telemetry, an agent transcript, or an accessible process listing. 3. A local user, administrator, monitoring integration, or log reader retrieves the password. 4. The attacker authenticates directly to Hacker News using the exposed reusable credential. ### Impact Assessment The exposed value is the user's Hacker News password rather than a narrowly scoped application token. Successful exploitation can therefore enable account takeover, including future logins after the local session cookie expires. The practical scope includes posting, commenting, profile modification, and any other action permitted by the compromised Hacker News account. No operating-system privilege e ...[truncated 34 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--password` and `-p` command-line options. - When no securely supplied secret is available, read the password interactively with `getpass.getpass()`. - Support a controlled secret manager or protected file descriptor for automated execution. - If environment-variable support is retained, warn users that child processes and diagnostic tooling may inherit or capture the variable. - Ensure errors and JSON output never include passwords, cookies, or complete request bodies. - Update the documentation to prohibit placing passwords directly in command lines and include guidance for clearing any shell history that already contains credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to place Hacker News credentials in environment variables but provides no warning about their sensitivity, storage lifetime, or leakage risks. In agent and CI environments, environment variables are commonly exposed to subprocesses, logs, crash reports, shell history, or debugging output, which can lead to account compromise if the credentials are reused or insufficiently protected.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries even though it clearly requires access to environment secrets and network capabilities to authenticate and post to Hacker News. Without declared restrictions, an agent runtime may over-grant access or make the skill callable in broader contexts than intended, increasing the risk of credential misuse, unintended posting, or abuse of stored session cookies.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script persists authenticated Hacker News session cookies to a predictable local file in the user's home directory and reloads them automatically on future runs. If that file is readable by other local users, copied into backups, or left on shared systems, an attacker could reuse the session and act as the victim account without knowing the password.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: cmd_login reads HN_USERNAME and HN_PASSWORD from environment variables, which are sensitive inputs that may be exposed through shell history, process environments, or misconfigured tooling. The code mentions the variables in an error message but does not provide any safety warning or disclosure about the risks of supplying credentials this way.