ClawHub
Back to skill

Security audit

订阅摘要(专业版)

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent RSS digest assistant, but it gives broad exec-enabled instructions for scheduled external delivery and user-history profiling without enough scoping or consent guidance.

Review before installing. Use only with RSS/feed-digest tasks, keep webhook URLs in a secret manager or protected environment variables, confirm every external destination, avoid private/internal feeds unless approved, and disable scheduled push or personalization unless you understand what content and history will be shared or retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill's safety guidance says sensitive information should not appear in output, yet multiple examples embed full webhook URLs directly in environment variables and config snippets. Even if placeholders are used in some places, this normalizes insecure handling of secrets and increases the chance users will paste real production webhooks into files, logs, screenshots, shell history, or agent-visible context.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation guidance is overly broad, describing generic data analysis, reporting, and visualization scenarios rather than narrowly scoped feed-digest tasks. In an agent environment, ambiguous routing can cause the skill to activate for unrelated requests and gain access to read/exec capabilities unnecessarily, expanding the attack surface.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The example trigger phrase '执行核心功能' is so generic that it could match ordinary conversation or unrelated tasks. In systems that use natural-language matching to activate skills, this increases the risk of accidental invocation of a powerful skill that includes exec, read, grep, and glob tools.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill promotes scheduled delivery to Feishu, Slack, email, and other channels but does not clearly warn that feed contents and summaries will be transmitted to third-party services. This matters because internal or sensitive feed content may leave the trusted environment without informed user consent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The personalization feature analyzes reading history but does not clearly disclose retention, profiling, or privacy implications. User activity data can reveal interests, projects, or internal priorities, making silent collection and analysis risky in enterprise contexts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents collection of reading history, click history, and user preferences without any privacy notice, retention limits, consent flow, or access controls. Even if the example only stores data in memory, it normalizes behavioral tracking and could lead implementers to collect sensitive user profiling data without appropriate safeguards.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The AI digest features prepare feed titles and summaries for submission to an LLM, but the documentation does not warn that third-party model processing may receive potentially sensitive content. This can result in unintentional data disclosure, especially if feeds include private internal summaries, proprietary research, or personal information.

Missing User Warnings

High
Confidence
97% confidence
Finding
The scheduled digest pusher automates transmission of generated content to external Feishu and Slack webhook endpoints without an explicit warning about outbound sharing or any visible controls on destination trust. In practice, this can leak internal feed content on a recurring basis to third-party services or misconfigured webhooks, amplifying exposure through unattended scheduled delivery.

External Transmission

Medium
Category
Data Exfiltration
Content
- type: slack
      url: https://hooks.slack.com/services/未指定
    - type: email
      url: https://api.email-service.com/send
# ...
team:
  teams:
Confidence
84% confidence
Finding
The skill explicitly supports transmitting data to external endpoints such as Slack webhooks and an email API. In context, external transmission is part of the advertised functionality, but it is still a real security concern because summaries, feed contents, and possibly internal metadata may be sent outside the local trust boundary.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.