ClawHub
Back to skill

Security audit

rss-aggregator

Security checks across malware telemetry and agentic risk

Overview

This RSS briefing skill is coherent and not malicious, but users should know it may fetch web content and maintain a local history log.

Install this only if you want an agent to fetch RSS/article pages and keep a local deduplication history of pushed titles and links. Review where pushed_history.log will be stored, whether your agent allows writes despite the read-only manifest, and whether the broad trigger keywords fit your routing setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest exposes only a read capability, but the workflow explicitly instructs appending to `pushed_history.log`. This mismatch can cause the agent to attempt undeclared side effects or push users/operators to grant broader file access than expected, undermining the trust boundary established by the manifest.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger keywords are broad generic terms such as `链接`, `rss`, and `aggregator`, which can match many unrelated user requests. Overbroad activation increases the chance the skill runs unintentionally, causing unexpected network fetching, content processing, or local history-file interactions without clear user intent.

Vague Triggers

High
Confidence
92% confidence
Finding
The repeated trigger list remains vague and unconstrained, reinforcing the same unintended-activation risk elsewhere in the document. Duplicating ambiguous triggers makes accidental invocation more likely across platforms that parse metadata or free-text descriptions for routing.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs writing titles and links to a local `pushed_history.log` file but gives no user-facing warning that local data will be created or modified. Silent local state changes can violate user expectations, create privacy issues, and persist data across runs without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.