ClawHub
Back to skill

Security audit

AI新闻

Security checks for vulnerabilities and agentic risk

Overview

This news skill should go to Review because it mixes a simple news API purpose with unrelated database, file-writing, and command-execution scope.

Review before installing. The core news-fetching behavior appears non-destructive and purpose-aligned, but the skill asks for broad agent capabilities and contains unrelated database/file/command claims. Install only if you are comfortable with an agent using shell-based API calls for this skill, and avoid invoking it for database or storage tasks unless the publisher narrows and documents that scope.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest describes a news-fetching skill but also claims it should be used for database operations, SQL queries, and storage management, which are unrelated to the documented behavior. This scope confusion can cause the agent to invoke the skill in inappropriate contexts and grant it unnecessary trust or tool access, increasing the chance of unintended command execution or data handling.

Intent-Code Divergence

Medium
Confidence
85% confidence
Finding
The skill states it does not support custom news sources, yet elsewhere advertises broad file handling and write capabilities that are unrelated to a fixed external news API. These contradictory claims make the skill's real behavior ambiguous, which can mislead an agent or operator into permitting actions beyond the intended trust boundary.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The documented feature set includes file handling and system command execution even though the stated purpose is only fetching and displaying news. Unnecessary execution-oriented capabilities materially expand the attack surface because an agent may enable exec-backed workflows for a skill that should only need outbound HTTP reads.

Vague Triggers

High
Confidence
92% confidence
Finding
The invocation description is contradictory and overly broad, mixing news retrieval with unrelated database and storage tasks. This can cause accidental or overly frequent invocation in sensitive contexts, allowing the skill to operate outside its intended domain and increasing misuse risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill description does not clearly warn users that it sends requests to an external API endpoint. Missing disclosure weakens informed consent and can expose user-derived inputs such as requested dates, topics, or context to third-party services unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
**处理步骤：**

1. 获取当前日期（格式：YYYY-MM-DD）
2. 调用 API：`curl -s "https://api.cjiot.cc/api/v1/daily?date={当前日期}"`
3. 解析返回的新闻列表
4. 按热度排序展示前 10 条新闻摘要
Confidence
83% confidence
Finding
The skill transmits data to an external domain, which is expected for a news API, but it still creates a real data-exposure boundary. Because the skill also declares exec capability and has ambiguous scope elsewhere, the external request becomes more concerning: users may not realize when information is leaving the local environment or what tool path is being used.

Static analysis

No suspicious patterns detected.