ClawHub
Back to skill

Security audit

AI News Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-news briefing workflow that browses listed public news sources and summarizes them, with no hidden persistence or destructive behavior found.

Install only through a trusted ClawHub/OpenClaw path or pin the CLI version when possible. Expect the skill to browse ten public AI news sources and send extracted public article text through the summarization/model workflow; avoid using it in environments where outbound browsing is restricted. Ask for a different output language if Chinese briefings are not desired.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:41
Finding

Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md:41-45
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash
npx clawhub install ai-news-briefing

Technical Analysis

The documented installation procedure invokes clawhub through npx without specifying a reviewed package version or integrity value. If the package is not already available locally, npx can retrieve the current package release from the configured npm registry and execute it with the invoking user's privileges.

Consequently, the code executed by this command can change after this skill has been reviewed. Compromise of the package publisher, npm account, registry, or a future clawhub release could turn the documented installation command into a supply-chain execution vector.

No evidence establishes that the current clawhub package is malicious. The vulnerability is the unsafe, unpinned trust relationship created by the documented command.

Attack Path

  1. An attacker compromises the clawhub package, its publisher account, its distribution infrastructure, or a future package release.
  2. The attacker publishes a release containing malicious package code or lifecycle behavior.
  3. A user follows the installation command in README.md.
  4. npx resolves and downloads the attacker-controlled current version because no version or integrity constraint is supplied.
  5. The downloaded package executes under the user's account during installation.
  6. The payload can perform actions permitted to that user before or while installing the skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the payload could access user-readable files, environment variables, development credentials, project data, and network resources, or mod ...[truncated 305 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawhub to a specific, reviewed version, for example:
    bash
    npx --yes clawhub@<reviewed-version> install ai-news-briefing
  2. Verify the selected release's provenance and integrity before recommending it.
  3. Use a lockfile and registry-provided integrity metadata when installation is managed through a package manifest.
  4. Document the expected trusted registry and avoid silently accepting packages from alternate registry configurations.
  5. Prefer installing a verified CLI release separately and invoking the locally pinned binary rather than downloading and executing the latest release in one step.
  6. Review new versions before updating the pinned version and perform installation using a least-privileged account in an isolated environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that the skill generates 'high-quality Chinese briefings,' which imposes a specific language by default. This is a natural-language policy concern because the documentation does not mention any option for the user to choose another language or explicitly opt into Chinese output.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly says the skill 'Generates professional Chinese news briefings,' reinforcing a fixed-language behavior. Because no alternative language option or opt-in is described, this appears to violate the requirement against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description and implementation hard-code Chinese output as the default behavior without offering a user-selectable language. While not a classic security flaw, it can cause user-intent mismatch, reduce transparency, and increase the chance that important warnings, source attributions, or summaries are delivered in a language the user did not request or cannot verify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly automates access to 10 third-party news sites via browser-execution, but it does not disclose outbound network activity, the set of contacted domains, or that retrieved content may be sent onward to another skill/model for summarization. This creates a transparency and privacy problem: users may trigger external requests and third-party data processing without informed consent, especially in environments where browsing activity or transmitted content is sensitive.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.