ClawHub
Back to skill

Security audit

订阅

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a rough RSS-to-Markdown helper, but its instructions ask for broad command, file, API, and credential-related authority that is not clearly scoped.

Review before installing. Use only if you are comfortable granting an agent read/write plus command execution authority for a poorly scoped RSS-to-Markdown skill. Avoid using it with sensitive feed URLs, credentials, internal network URLs, or broad file/workflow tasks unless the publisher narrows the instructions and clarifies whether processing is local or remote.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill’s manifest frames the tool as a narrow local RSS/Atom-to-Markdown converter, but the description simultaneously broadens scope to generic file processing and workflow use. This mismatch can cause an agent or user to grant broader trust and invoke the skill in contexts beyond its stated purpose, increasing the chance of unsafe tool use and privilege creep.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
Advertising command execution in a skill whose stated function is feed conversion is a dangerous capability expansion. In an agent environment with exec access, this can normalize or justify running arbitrary shell commands derived from user input or feed content, potentially leading to code execution, local file access, or system abuse.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The documentation presents generic API/external-service integration even though the skill is described as using a bundled local converter. This inconsistency can mislead operators about data flow and cause external transmission of feed URLs or content where local-only processing was expected, creating unnecessary exposure and trust confusion.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The skill claims both bundled local conversion and API-key-based/external API operation, which sends contradictory intent signals. In security-sensitive agent ecosystems, such contradictions hinder risk assessment and can conceal unexpected network access, secret handling, or remote processing behind a seemingly local tool.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The invocation description is overly broad and ambiguous, encouraging use for loosely related document, extraction, and workflow tasks rather than a narrowly defined feed-conversion function. Ambiguous activation scope increases the likelihood that an agent selects this skill in inappropriate contexts, where its read/exec/write permissions become more dangerous.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The core feature summary uses vague broad-use wording instead of a specific activation boundary. In a tool-enabled agent, vague summaries can cause over-selection of the skill and expand effective authority beyond the minimum needed for the requested task.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation does not clearly warn that converting a feed URL requires network access to external hosts. Without an explicit notice, users and agents may treat the skill as purely local, leading to unintended outbound requests, privacy leakage of requested URLs, or use against internal/localhost endpoints if not otherwise restricted.

Static analysis

No suspicious patterns detected.