ClawHub
Back to skill

Security audit

RSS摘要工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This RSS summarizer is mostly purpose-aligned, but its unverified executable install path and unrestricted fetching of feed-provided URLs warrant Review before installation.

Install only if you trust the feed CLI source and can verify or pin the dependency. Use the skill with network safeguards for RSS URLs, avoid fetching unknown or private-network destinations, and require explicit confirmation before importing feeds or marking entries as read.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:195
Finding

Unpinned Third-Party Executable Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 195-199; dependency reiterated at line 306
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Relevant Code Snippet:

bash
brew install odysseus0/tap/feed
git clone https://example.com/feed.git
cd feed && cargo install --path .

Technical Analysis

The installation workflow obtains executable code from a third-party Homebrew tap or a remote source repository without pinning an immutable version, commit hash, checksum, or cryptographic signature. The source-build alternative also references a placeholder repository and immediately invokes Cargo against the downloaded project.

Package installation and build processes can execute package scripts or compile attacker-controlled source code. Consequently, the effective code executed by the Skill user can change after the Skill has been reviewed. The Skill does not provide controls for verifying the identity or integrity of the downloaded dependency.

Network installation of an RSS client is consistent with the declared functionality, but using mutable and insufficiently verified sources grants the dependency more trust than is minimally necessary.

Attack Path

  1. An attacker compromises the referenced Homebrew tap, its package definition, the remote repository, or the associated release infrastructure.
  2. The attacker replaces the expected dependency with a malicious package or modifies its build process.
  3. A user follows the documented installation instructions.
  4. Homebrew or Cargo downloads and executes or compiles the attacker-controlled content.
  5. The malicious dependency runs with the privileges of the Agent or local user who performed the installation.

Impact Assessment

Successful exploitation can result in arbitrary code execution under the installing user's account. Depending on that account's existing access, ...[truncated 445 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the placeholder repository with the verified official project repository.
  2. Pin the dependency to a specific release and immutable commit hash.
  3. Publish and verify SHA-256 checksums or cryptographic signatures before installation.
  4. Pin the Homebrew formula version and document the provenance of the third-party tap.
  5. Review Cargo manifests and build scripts before executing a source installation.
  6. Prefer reproducible builds or a trusted package registry with lockfile enforcement.
  7. Run the dependency with ordinary user privileges and limit its filesystem and network access where sandboxing is available.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:258
Finding

Unrestricted Fetching of Feed-Controlled URLs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 258
Vulnerability Type: Server-Side Request Forgery through unvalidated URL retrieval
Risk Level: Medium

Relevant Instruction, rendered in English:

text
The entry table contains complete URLs. Prefer having the AI fetch URLs
directly through WebFetch so that the full text does not enter the context
window and tokens are saved. Fall back to `feed get entry <id>` only
when network-fetching capability is unavailable.

Technical Analysis

The Skill directs the Agent to retrieve complete URLs taken from RSS entry data but does not require validation of the URL scheme, hostname, resolved IP address, port, or redirect destination. RSS entries may originate from untrusted or attacker-controlled publishers.

An attacker can place a URL targeting localhost, a private network, a link-local service, or a cloud metadata endpoint into an RSS entry. Redirects and DNS rebinding may also allow a URL that initially appears public to resolve or redirect to an internal destination.

Fetching remote article content is necessary for the declared summarization functionality. However, unrestricted access to arbitrary destinations exceeds minimum privilege because ordinary RSS summarization only requires access to expected public web resources.

The flagged instruction does not itself explicitly upload local secrets to an external service. Its primary confirmed risk is unauthorized network access and possible disclosure of fetched internal content. The optional callback_url documented elsewhere is not accompanied by an execution instruction and therefore does not independently establish exfiltration.

Attack Path

  1. An attacker publishes or controls an RSS feed entry.
  2. The entry includes a URL such as a localhost, private-network, link-local, metadata-service, or attacker-controlled redirect URL.
  3. The feed is imported or fetched by the user.
  4. F ...[truncated 1087 chars]
Remediation
View remediation

Remediation Suggestions

  1. Permit only https URLs and reject local-file, loopback, custom, and non-web schemes.
  2. Resolve hostnames before each request and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
  3. Repeat destination validation after every redirect and impose a strict redirect limit.
  4. Use an allowlist of known RSS publisher domains where practical.
  5. Block embedded credentials, unexpected ports, and malformed or ambiguous host representations.
  6. Disable ambient authentication, cookies, client certificates, and authorization headers for feed-derived requests.
  7. Require explicit user confirmation before fetching unknown or newly observed domains.
  8. Apply response-size, timeout, and content-type limits.
  9. Prefer retrieving content already stored by the RSS client when a destination cannot be validated safely.
  10. Document that content fetched from RSS URLs is untrusted and must not be treated as Agent instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger condition text references SEO optimization, keyword analysis, ranking improvement, and search traffic optimization, which is inconsistent with an RSS digest tool. Overbroad or mismatched triggers can cause the agent to activate this skill in unrelated contexts and then use exec/network capabilities unexpectedly, increasing the chance of unintended command execution or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

该技能的展示名称、摘要和全文说明均固定为中文，且未说明是否支持其他语言或允许用户选择输出语言。对于面向通用Agent平台的技能，这种未提供用户语言选择的固定语言设定可能构成语言/locale策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill instructs the agent to use direct URL fetching and also exposes write-capable commands, but it does not provide clear user-facing warnings about network access, third-party content retrieval, privacy implications, or state changes. In an agent environment, this can lead users to unknowingly permit external requests or local data mutations that have operational or privacy consequences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description emphasizes a three-step read-oriented workflow: scanning feeds, filtering entries, and synthesizing summaries for personal reading. However, the skill also claims support for batch marking items as read and later documents import/setup operations, which are state-changing feed-management actions rather than digest generation itself.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill simultaneously presents read-state mutation as a supported command while elsewhere stating the AI should not automatically mark items as read. In an agent context with exec access, this ambiguity can lead to unintended state-changing actions that alter a user's RSS workflow or hide unread items without clear consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes scanning existing subscriptions, extracting unread items, filtering, and summarizing. The quick-start instructions add feed import starter-tech-blogs.opml, which is a content/source management capability not mentioned in the declared core abilities or use cases.

Content

No source excerpt is available for this finding.