Miniflux

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:02 AM UTC
• Version: 0.1.5

Overview

This Miniflux skill is purpose-aligned but needs review because it asks users to run an unpinned native MCP binary that receives account credentials and can modify RSS account data.

Review before installing. Prefer read-only mode unless you need write actions, use a revocable Miniflux API token instead of a password, pin and verify the MCP binary or Cargo version if possible, and manually confirm destructive actions such as deleting feeds/categories, importing OPML, or bulk status changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned and Unverified Third-Party MCP Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-46
Vulnerability Type: Supply-chain risk from an unpinned, externally downloaded executable
Risk Level: Medium

Vulnerable Code

markdown

### `openclaw-miniflux-mcp` binary

Download the latest binary for your platform from
[GitHub Releases](https://github.com/sinhong2011/openclaw-skill-miniflux/releases):

| Platform | Binary |
|----------|--------|
| Linux x86_64 | `openclaw-miniflux-mcp-x86_64-unknown-linux-gnu` |
| Linux ARM64 | `openclaw-miniflux-mcp-aarch64-unknown-linux-gnu` |
| macOS x86_64 | `openclaw-miniflux-mcp-x86_64-apple-darwin` |
| macOS ARM64 | `openclaw-miniflux-mcp-aarch64-apple-darwin` |

Or install via Cargo:

```bash
cargo install openclaw-miniflux-mcp

text

### Technical Analysis

The installation instructions direct users to retrieve the “latest” release or install the Cargo package without specifying an audited version, immutable artifact reference, cryptographic checksum, or signature-verification procedure. The downloaded executable is not included in the audited project, so its implementation and network behavior cannot be verified from `SKILL.md`.

This external process is configured elsewhere in the document to receive a Miniflux API token or username and password through environment variables. It also implements read, write, import, export, and deletion operations against the Miniflux instance. Consequently, compromise of the upstream publisher account, release artifacts, package registry entry, or a future release could turn this trusted dependency into a credential-theft or arbitrary-code-execution channel.

The network transmission of credentials to the configured Miniflux service is necessary for the declared functionality, and the reviewed document does not explicitly direct data to an attacker-controlled endpoint. The risk arises because the unverified executable controls that transmission and execu
...[truncated 1673 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP dependency to a specific, reviewed release rather than instructing users to install the latest version.
2. Use immutable release URLs and document the exact expected artifact name and version for every supported platform.
3. Publish SHA-256 or stronger checksums through a trusted channel and require users or installation automation to verify them before execution.
4. Sign release artifacts and document signature verification, including the expected signing-key fingerprint.
5. Pin Cargo installation explicitly, for example with cargo install openclaw-miniflux-mcp --version <audited-version> --locked.
6. Prefer reproducible builds from a pinned, reviewed source revision where practical.
7. Run the MCP process under a dedicated, restricted operating-system account or sandbox with minimal filesystem and network access.
8. Recommend read-only mode by default and enable write tools only when the user's requested workflow requires them.
9. Use narrowly scoped, revocable API tokens instead of account passwords whenever supported.
10. Require HTTPS for non-local Miniflux endpoints and warn users not to transmit credentials over plaintext HTTP.
11. Add explicit user confirmation before destructive feed or category deletion operations.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest uses broad natural-language examples like 'show my unread articles', 'rename this category', and 'unsubscribe from this feed' without clear activation boundaries or stronger scoping language. That increases the chance an agent will invoke this skill in loosely related contexts and may expose or modify Miniflux data when the user did not explicitly intend to operate on their RSS account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises write capabilities including create/update/delete feeds and categories, OPML import, marking entries as read, and bookmark changes, but the top-level capability description does not prominently warn that these actions can permanently change account state. In an agentic setting, that makes accidental destructive actions more plausible, especially because the skill is designed to be broadly usable for account management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.