Security audit

AK RSS 24h Brief

Security checks for vulnerabilities and agentic risk

Overview

This RSS brief skill is mostly coherent, but it needs Review because its feed fetcher can contact arbitrary or internal URLs from an OPML file without validation or resource limits.

Install only if you are comfortable with it making outbound requests to every URL in the OPML feed list. Prefer trusted OPML files, run it in a sandboxed environment without access to internal networks or sensitive local files, and keep workers/feed counts conservative until URL and response-size validation are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_brief.py:18
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Local Resource Access
Content: View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": "openclaw-hn-rss-brief/1.0"}) with urllib.request.urlopen(req, timeout=timeout) as r: charset = r.headers.get_content_charset() or "utf-8" return r.read().decode(charset, errors="replace") ``` The initial OPML source is retrieved without destination validation: ```python if args.opml_url: opml_text = fetch_text(args.opml_url, timeout=args.timeout) else: with open(args.opml_file, 'r', encoding='utf-8') as f: opml_text = f.read() feed_urls = parse_opml(opml_text)[: args.max_feeds] ``` Every URL extracted from the OPML document is subsequently fetched: ```python def work(url: str) -> Tuple[str, List[Entry], Optional[str]]: try: text = fetch_text(url, timeout=args.timeout) es = parse_feed(url, text) return url, es, None except Exception as e: return url, [], str(e) ``` ### Technical Analysis The Skill legitimately requires outbound network access to retrieve an OPML subscription list and its RSS or Atom feeds. However, the implementation grants substantially broader network access than this functionality requires. Both the user-supplied `--opml-url` and every `xmlUrl` extracted from an OPML document are passed directly to `urllib.request.urlopen`. The implementation does not: - Restrict requests to HTTP or HTTPS. - Require encrypted HTTPS transport. - Reject URLs containing embedded credentials. - Block loopback, private, link-local, multicast, reserved, or cloud metadata IP addresses. - Revalidate hostnames after DNS resolution. - Validate redirect destinations. - Restrict feed retrieval to trusted domains. - Exp ...[truncated 2336 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_brief.py:18
Finding: Unbounded Concurrent Response Processing Enables Resource Exhaustion
Content: View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": "openclaw-hn-rss-brief/1.0"}) with urllib.request.urlopen(req, timeout=timeout) as r: charset = r.headers.get_content_charset() or "utf-8" return r.read().decode(charset, errors="replace") ``` Multiple responses may be fetched and buffered concurrently: ```python with concurrent.futures.ThreadPoolExecutor(max_workers=max(1, args.workers)) as ex: futures = [ex.submit(work, u) for u in feed_urls] for fu in concurrent.futures.as_completed(futures): _, entries, _ = fu.result() all_entries.extend(entries) ``` ### Technical Analysis `r.read()` reads the complete response body into memory without enforcing a maximum compressed size, decompressed size, or decoded character count. The resulting text is then passed to the XML parser. The user can also control `--workers` and `--max-feeds`. Although the documented defaults are 10 workers and 200 feeds, the code does not impose secure upper bounds. Multiple large or slow responses can therefore be processed concurrently. The configured timeout limits individual blocking operations but does not provide: - A maximum response-body size. - An aggregate download budget. - A total execution deadline. - A maximum decompressed response size. - A maximum XML element or entry count. - A safe upper bound on worker or feed counts. Consequently, malicious or unexpectedly large feed servers can consume excessive memory, CPU, network bandwidth, file descriptors, or execution time. ### Attack Path 1. An attacker controls an OPML document or one or more feed URLs listed in it. 2. The attacker-operated feed endpoints return very large response b ...[truncated 1196 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description requires the skill to "generate a Chinese categorized brief," which imposes a specific language on all outputs. This is a natural-language policy concern because the file does not indicate any user opt-in, alternative language support, or region-specific justification for the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The constraint states that each item must be "a Chinese content summary" and forbids embedded English sentences, which hard-codes a language requirement. Because no opt-in or alternative locale handling is described, this appears to violate the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple strings and the core brief-generation function explicitly produce Chinese summaries and describe the tool as generating a Chinese brief. This is a natural-language locale constraint with no option for the user to select another language or opt in to Chinese output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code fetches data from a user-supplied OPML URL and then requests every feed URL listed within it, which transmits system network activity to external hosts. While the behavior is central to the script's purpose, there is no user-facing print, warning, or comment disclosing that remote URLs from the OPML will be contacted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.