ClawHub
Back to skill

Security audit

中国新闻聚合(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a straightforward RSS news-brief skill, with visible command execution and file output that users should understand before running it.

Install only if you are comfortable letting the agent run Python commands, install the requests package if needed, fetch public RSS feeds from the internet, and write generated news files or cache data into the working directory or configured output directory. Do not provide a callback URL unless you explicitly want the agent to contact that endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill exposes arbitrary command execution even though its stated purpose is lightweight RSS aggregation and report generation. In an agent environment, unnecessary exec access materially increases the blast radius: prompt-influenced inputs or future modifications could lead to filesystem changes, data exfiltration, or execution of attacker-chosen shell commands unrelated to RSS fetching.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill writes generated briefs and cache files to disk, including to a path influenced by environment configuration, without prominently warning users in the skill description. In agent workflows this can create unintended data persistence, accidental overwrite of local files, or retention of fetched content in shared workspaces where users may expect transient processing only.

Missing User Warnings

High
Confidence
94% confidence
Finding
The documented callback_url parameter enables sending processing results to an external endpoint, but the skill description does not warn users that fetched content or derived output may be transmitted off-platform. In an agent context, silent outbound delivery can expose sensitive prompts, aggregated content, or internal metadata to attacker-controlled URLs, especially if users assume the tool is local-only RSS processing.

Static analysis

No suspicious patterns detected.