ClawdBot Blog Watcher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

The skill is a simple blog/RSS monitor, but it advertises shell execution and broad file access without explaining why those powers are needed or how they are controlled.

Review before installing. This does not show malicious code, exfiltration, or persistence, but it should be narrowed to web/RSS retrieval and a clearly scoped storage mechanism, or it should explicitly require confirmation and path limits before any shell command or file operation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Excessive System Tool Permissions for RSS Monitoring

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-21
Vulnerability Type: Excessive tool scope and violation of least privilege
Risk Level: Medium

Vulnerable Code

markdown

## Available Tools

This skill uses ClawdBot's standard tools:
- **bash** - Execute commands
- **read_file** - Read files
- **write_file** - Write files  
- **web_fetch** - Fetch web content
- **web_search** - Search the web

Technical Analysis

The skill's stated purpose is to monitor blogs and RSS feeds, which ordinarily requires only narrowly scoped network retrieval and, if necessary, restricted storage for feed state. However, the skill declares access to unrestricted command execution through bash and general local file access through read_file and write_file.

The document does not define command allowlists, filesystem boundaries, approved storage paths, feed-origin restrictions, or safeguards for handling untrusted content. It also directs the agent to select “appropriate tools” without establishing security constraints. This creates a least-privilege violation: capabilities with significant host impact are available even though they are not justified by the stated monitoring function.

No explicit malicious commands or executable payloads were found. Exploitation therefore depends on the host granting the listed tools and on malicious or untrusted input influencing tool selection or arguments.

Attack Path

1. A user activates the Blog Watcher skill and supplies an untrusted or attacker-controlled blog or RSS source.
2. The skill retrieves content from that source using its network tools.
3. Crafted content, misleading instructions, or an adversarial user request influences the agent to treat a local operation as necessary for monitoring.
4. Because the skill declares bash, read_file, and write_file, the agent may invoke these capabilities without purpose-specific restrictions.
5. Depe ...[truncated 841 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove bash, read_file, and write_file from the declared tool set unless each capability is demonstrably required.
2. Use only a narrowly scoped HTTP or RSS retrieval tool for feed monitoring.
3. If persistence is required, replace general filesystem access with a dedicated storage interface restricted to a single application-owned directory or structured key-value namespace.
4. If command execution is unavoidable, use a fixed command allowlist, prohibit shell interpolation, validate every argument, and execute within a sandbox with minimal operating-system privileges.
5. Define an explicit allowlist of supported URL schemes and, where practical, approved feed origins. Block localhost, link-local, private-network, and metadata-service addresses to reduce server-side request risks.
6. Treat all blog and RSS content as untrusted data. Explicitly prohibit interpreting retrieved content as agent instructions or tool-call authorization.
7. Require user confirmation for any local file modification or command execution and log all privileged tool invocations.
8. Document the exact monitoring workflow, required permissions, storage locations, and security boundaries rather than directing the agent generically to choose any “appropriate” tool.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation explicitly advertises access to bash and write_file even though the stated purpose is only monitoring blogs and RSS feeds. That mismatch increases attack surface and can normalize unnecessary powerful actions, making prompt-injection or user-triggered misuse more dangerous if the skill is invoked in untrusted content-handling workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger example "Help me with blog watcher" is broad and overlaps with natural conversation, which can cause accidental or overly permissive activation. In a skill with access to web, shell, and file-writing tools, unintended invocation raises the chance that unrelated user input or hostile content is processed under elevated capabilities.

Content

No source excerpt is available for this finding.