ClawHub
Back to skill

Security audit

RSS转MD(专业版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed RSS-to-Markdown archiving assistant, but it asks for broad execution authority and includes under-scoped scheduled, file-writing, and document-conversion examples that deserve user review.

Install only if you are comfortable with an agent fetching RSS URLs, writing archive/export files, optionally using an LLM, and running local conversion tools. Use trusted feeds, keep outputs in a dedicated folder, avoid enabling scheduled archiving until you have reviewed the paths, and sandbox or skip PDF/EPUB conversion for untrusted content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill advertises file saving, scheduled archiving, image downloading, and full-content retrieval while exposing powerful tools including exec, yet it does not consistently require explicit user confirmation, destination/path constraints, or safe defaults for data-impacting actions. In an agent context, that can lead to unintended persistent writes, repeated scheduled activity, or broad remote content retrieval with privacy, storage, and operational consequences.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The examples write files to user-supplied paths and perform multi-format exports without any warning, consent flow, or path restrictions. In an agent skill context, silent local file modification is dangerous because users may trigger writes unintentionally, and downstream components may overwrite sensitive files or create artifacts in unexpected locations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The batch conversion example fetches arbitrary feed URLs over the network without a user-facing warning or apparent allowlisting. In an agent environment, silent outbound requests can leak metadata, contact attacker-controlled hosts, or be abused for SSRF-like access if internal URLs are accepted.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The examples invoke external utilities for PDF/EPUB conversion without warning the user that local executables will be run. In a skill context, unexpected subprocess execution increases attack surface, can process attacker-controlled content with complex parsers, and may expose the host to vulnerabilities in tools like wkhtmltopdf or pandoc.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The AI enhancement example sends feed content into an LLM-like processing path without warning users about possible data disclosure. Even though the current implementation is stubbed, the design pattern normalizes forwarding potentially sensitive content to an AI component, which becomes risky once connected to a real external model service.

Unvalidated Output Injection

High
Category
Output Handling
Content
import subprocess
        try:
            subprocess.run(['wkhtmltopdf', html_path, output_path], check=True)
            return output_path
        except Exception as e:
            print(f"PDF转换失败：{e}")
Confidence
88% confidence
Finding
The code passes generated HTML derived from feed content into wkhtmltopdf, a powerful external renderer with a history of risky behaviors around active content, local file access, and network retrieval depending on configuration. Because the HTML embeds unescaped feed title and markdown content directly, an attacker controlling feed data may be able to trigger unsafe renderer behavior, data exposure, or processing of hostile content when PDF export is run.

Unvalidated Output Injection

High
Category
Output Handling
Content
import subprocess
        try:
            subprocess.run(['pandoc', md_path, '-o', output_path], check=True)
            return output_path
        except Exception as e:
            print(f"EPUB转换失败：{e}")
Confidence
81% confidence
Finding
The code invokes pandoc on markdown generated from untrusted feed content and writes to a caller-controlled output path. While there is no shell injection here, feeding attacker-controlled content into a complex document conversion tool can expose parser/renderer attack surface and may permit unintended file access or unsafe includes depending on pandoc features and environment.

Static analysis

No suspicious patterns detected.