ClawHub
Back to skill

Security audit

央视新闻抓取(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed CCTV news scraping and briefing tool, but it needs review because it combines broad activation wording with arbitrary webhook/email delivery and exec-based setup guidance.

Install only if you intend to use the CCTV news scraping and external briefing workflows. Review webhook and email destinations before use, avoid sending internal or sensitive analysis through the generic push channel, and prefer safer package-manager or verified installer steps instead of piping remote scripts into a shell.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation guidance is extremely broad, including generic AI/agent usage contexts rather than narrowly scoped triggers for this specific news-grabbing skill. In an agent environment with read/exec/glob/grep permissions, vague invocation criteria increase the chance the skill is selected unexpectedly and performs scraping, subprocess execution, or outbound actions when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example trigger phrase '执行核心功能' is so generic that an agent could invoke this skill for unrelated tasks. Because the skill advertises command execution and external integrations, a generic trigger can cause overbroad tool activation and unintended execution flow in a privileged agent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill accepts a callback_url and later describes push/webhook delivery, but it does not present a clear, prominent warning that fetched content, summaries, and possibly user-supplied data may be transmitted to third-party endpoints. In agent settings, hidden or under-emphasized outbound transmission paths can lead to accidental data exfiltration or privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file provides ready-to-use webhook push code that sends arbitrary news content to external services (Feishu, DingTalk, WeChat, Slack, email, generic webhooks) but does not warn users that content will leave the local environment. In an agent-skill context, this creates a real data exfiltration risk because operators may adapt the example to sensitive inputs without explicit consent, allowlisting, or disclosure controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This finding reflects intentional external transmission capability via email/webhook endpoints. In this skill's context, outbound delivery is a core feature, but it still creates real security risk because news content, summaries, and possibly internal analysis can be sent to third-party services without strong destination controls or data minimization guarantees.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md
url: https://qyapi.weixin.qq.com/cgi-（请参考skill目录中的脚本文件）?key=未指定
    - name: email
      type: email
      url: https://api.email-service.com/send
# ...
analyzer:
  top_keywords: 20

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs an outbound HTTP POST to a caller-supplied webhook URL containing message content. In an agent environment, if the content includes sensitive data or the URL is attacker-controlled, this enables straightforward data exfiltration to an external service.

Content

Scanner excerpt · references/detail.md (reported line 176)May include surrounding context.

md
"elements": [{"tag": "div", "text": {"tag": "lark_md", "content": content}}]
            }
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_dingtalk(self, url, title, content):

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This DingTalk example sends content via requests.post to an external webhook endpoint. Because both destination and transmitted content are variable, misuse can disclose internal or sensitive information outside the platform boundary.

Content

Scanner excerpt · references/detail.md (reported line 185)May include surrounding context.

md
"msgtype": "markdown",
            "markdown": {"title": title, "text": f"## {title}\n\n{content}"}
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_wechat(self, url, title, content):

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This WeCom webhook call transmits content directly to an external URL. In context, the example is operationally useful, but without guardrails it can be repurposed to export agent-visible data to third-party endpoints.

Content

Scanner excerpt · references/detail.md (reported line 194)May include surrounding context.

md
"msgtype": "markdown",
            "markdown": {"content": f"## {title}\n{content}"}
        }
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_email(self, url, title, content):

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This email push helper posts subject/body content to an external endpoint, which may bridge agent-generated data into another system. If connected to sensitive summaries or internal content, it creates a concrete exfiltration path.

Content

Scanner excerpt · references/detail.md (reported line 200)May include surrounding context.

md
def _push_email(self, url, title, content):
        """邮件推送"""
        payload = {"subject": title, "body": content, "format": "markdown"}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_slack(self, url, title, content):

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This Slack push method sends arbitrary title/content to an external webhook. In a skill setting, such generic external transmission is dangerous when combined with agent access to internal data because it can leak that data to an external workspace.

Content

Scanner excerpt · references/detail.md (reported line 206)May include surrounding context.

md
def _push_slack(self, url, title, content):
        """Slack推送"""
        payload = {"text": f"*{title}*\n{content}"}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

    def _push_generic(self, url, title, content):

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The generic push helper is the broadest exfiltration primitive because it POSTs arbitrary content to any provided URL without service-specific constraints. That flexibility makes the skill context more dangerous: a user or downstream component can direct potentially sensitive agent-produced content to attacker-controlled infrastructure.

Content

Scanner excerpt · references/detail.md (reported line 212)May include surrounding context.

md
def _push_generic(self, url, title, content):
        """通用推送"""
        payload = {"title": title, "content": content}
        r = requests.post(url, json=payload, timeout=10)
        return r.status_code == 200

pusher = NewsPusher()

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The documentation recommends piping a remote script directly into bash (curl ... | bash) to install Bun. This is dangerous because it executes network-fetched code immediately without integrity verification, exposing users to supply-chain compromise, MITM-related trust failures, or malicious installer changes.

Content

Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.

md
| 依赖项 | 类型 | 是否必需 | 获取方式 |
|---:|---:|---:|---:|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| node-html-parser | npm包 | 必需 | `npm install node-html-parser` |
| Python 3.8+ | 运行时 | 必需 | 官网下载安装 |
| requests | Python库 | 必需 | `pip install requests`（推送功能） |

Static analysis

No suspicious patterns detected.