ClawHub
Back to skill

Security audit

Miniflux

Security checks for vulnerabilities and agentic risk

Overview

This Miniflux skill is purpose-aligned but needs review because it asks users to run an unpinned native MCP binary that receives account credentials and can modify RSS account data.

Review before installing. Prefer read-only mode unless you need write actions, use a revocable Miniflux API token instead of a password, pin and verify the MCP binary or Cargo version if possible, and manually confirm destructive actions such as deleting feeds/categories, importing OPML, or bulk status changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding
Unpinned and Unverified Third-Party MCP Executable## Vulnerability Details **File Location**: `SKILL.md`, lines 32-46 **Vulnerability Type**: Supply-chain risk from an unpinned, externally downloaded executable **Risk Level**: Medium ### Vulnerable Code ```markdown ### `openclaw-miniflux-mcp` binary Download the latest binary for your platform from [GitHub Releases](https://github.com/sinhong2011/openclaw-skill-miniflux/releases): | Platform | Binary | |----------|--------| | Linux x86_64 | `openclaw-miniflux-mcp-x86_64-unknown-linux-gnu` | | Linux ARM64 | `openclaw-miniflux-mcp-aarch64-unknown-linux-gnu` | | macOS x86_64 | `openclaw-miniflux-mcp-x86_64-apple-darwin` | | macOS ARM64 | `openclaw-miniflux-mcp-aarch64-apple-darwin` | Or install via Cargo: ```bash cargo install openclaw-miniflux-mcp ``` ``` ### Technical Analysis The installation instructions direct users to retrieve the “latest” release or install the Cargo package without specifying an audited version, immutable artifact reference, cryptographic checksum, or signature-verification procedure. The downloaded executable is not included in the audited project, so its implementation and network behavior cannot be verified from `SKILL.md`. This external process is configured elsewhere in the document to receive a Miniflux API token or username and password through environment variables. It also implements read, write, import, export, and deletion operations against the Miniflux instance. Consequently, compromise of the upstream publisher account, release artifacts, package registry entry, or a future release could turn this trusted dependency into a credential-theft or arbitrary-code-execution channel. The network transmission of credentials to the configured Miniflux service is necessary for the declared functionality, and the reviewed document does not explicitly direct data to an attacker-controlled endpoint. The risk arises because the unverified executable controls that transmission and execu ...[truncated 1673 chars]
Remediation
## Remediation Suggestions 1. Pin the MCP dependency to a specific, reviewed release rather than instructing users to install the latest version. 2. Use immutable release URLs and document the exact expected artifact name and version for every supported platform. 3. Publish SHA-256 or stronger checksums through a trusted channel and require users or installation automation to verify them before execution. 4. Sign release artifacts and document signature verification, including the expected signing-key fingerprint. 5. Pin Cargo installation explicitly, for example with `cargo install openclaw-miniflux-mcp --version <audited-version> --locked`. 6. Prefer reproducible builds from a pinned, reviewed source revision where practical. 7. Run the MCP process under a dedicated, restricted operating-system account or sandbox with minimal filesystem and network access. 8. Recommend read-only mode by default and enable write tools only when the user's requested workflow requires them. 9. Use narrowly scoped, revocable API tokens instead of account passwords whenever supported. 10. Require HTTPS for non-local Miniflux endpoints and warn users not to transmit credentials over plaintext HTTP. 11. Add explicit user confirmation before destructive feed or category deletion operations.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The manifest uses broad natural-language examples like 'show my unread articles', 'rename this category', and 'unsubscribe from this feed' without clear activation boundaries or stronger scoping language. That increases the chance an agent will invoke this skill in loosely related contexts and may expose or modify Miniflux data when the user did not explicitly intend to operate on their RSS account.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises write capabilities including create/update/delete feeds and categories, OPML import, marking entries as read, and bookmark changes, but the top-level capability description does not prominently warn that these actions can permanently change account state. In an agentic setting, that makes accidental destructive actions more plausible, especially because the skill is designed to be broadly usable for account management.

Static analysis

No suspicious patterns detected.