T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_and_transcribe.sh:36- Finding
Unrestricted Feed and Enclosure URL Fetching Permits SSRF and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
Security audit
HN Podcast Transcriber
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it can fetch arbitrary podcast feed and audio URLs repeatedly without enough network, size, or destination limits.
Install only if you are comfortable with a script that downloads RSS feeds and audio to a local archive and may run on a schedule. Prefer a trusted feed, avoid arbitrary or attacker-provided RSS URLs, run it as a low-privilege user in a contained directory, avoid unattended scheduling until URL allowlists and size limits are added, and install Whisper/FFmpeg in an isolated environment with reviewed versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:12- Finding
Unpinned Third-Party Package Installation Instruction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs users to run shell scripts that fetch remote content, write files, use environment-dependent tools, and access the network, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance the agent is invoked with broader capabilities than necessary, making misuse or unintended execution against arbitrary feeds more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description goes beyond a narrowly defined Hacker News transcription use case and explicitly says to use the skill for any podcast RSS workflow. Broad activation language can cause over-triggering in unrelated contexts and, combined with network and shell behavior, may lead an agent to fetch and process attacker-controlled RSS feeds or write untrusted content to disk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill recommends persistence via cron or heartbeat-based recurring execution, which creates an automated mechanism for repeated network fetches, downloads, and file writes. Persistence makes any misconfiguration, compromised feed source, or unsafe downstream script behavior more dangerous because exploitation can recur without additional user approval.
- Content
md Set up an OpenClaw cron job for daily checks: 1. Create an isolated cron job that runs the script 2. Or add a heartbeat check in HEARTBEAT.md ## Archive Structure
Static analysis
No suspicious patterns detected.