ClawHub
Back to skill

Security audit

RSS聚合摘要免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward RSS digest helper whose network fetching and file output are expected for its purpose, with a few privacy and file-handling cautions for users.

Install only if you are comfortable letting the agent run a Python RSS-fetching command against the feed URLs you provide. Use trusted feed URLs, avoid credentials in URLs, choose output paths carefully to prevent overwrites, and review any crontab entry before enabling recurring runs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill encourages writing output files and even shows recurring cron-based generation, but it does not prominently warn users that execution will create and overwrite local files on a schedule. In agent environments with exec capability, unclear file-write behavior can lead to unintended persistence, disk clutter, accidental overwrites, or sensitive data being stored in predictable locations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill fetches third-party RSS URLs over the network, but it does not clearly warn users that supplied feed URLs will result in outbound requests that disclose IP, user-agent, access timing, and possibly embedded credentials if users follow the documented URL-auth pattern. In a tool with exec and network access, missing privacy guidance materially increases the risk of unintentional data exposure and contact with untrusted endpoints.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.