Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real AI news digest skill, but its default X/Twitter integration handles browser session cookies and inherited environment secrets too broadly.
Review this skill before installing if you use X/Twitter in Chrome or keep API keys in your agent environment. Prefer disabling or removing the X/Twitter source unless you accept browser-cookie access, run setup in a clean environment with minimal secrets, and consider pinning dependencies before use.
fetch.py:402Authenticated X/Twitter Session Credentials and Unrelated Environment Secrets Are Exposed to a Third-Party Subprocess
scripts/setup-env.sh:23Security-Sensitive Dependencies Are Installed from Broad Version Ranges Without Integrity Pinning
sections/daily-mode.md:11Untrusted Article Content Is Passed to a Tool-Capable Agent Without Prompt-Injection Isolation
If the wider skill/package includes release automation that edits metadata files, performs git operations, and publishes externally, that is materially different from the declared end-user purpose of ranking news. Hidden repository modification and publication behavior can cause unintended code changes or external disclosure when run in an agent context.
If the wider skill/package includes release automation that edits metadata files, performs git operations, and publishes externally, that is materially different from the declared end-user purpose of ranking news. Hidden repository modification and publication behavior can cause unintended code changes or external disclosure when run in an agent context.
If the wider skill/package includes release automation that edits metadata files, performs git operations, and publishes externally, that is materially different from the declared end-user purpose of ranking news. Hidden repository modification and publication behavior can cause unintended code changes or external disclosure when run in an agent context.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Dedup file: `{data_dir}/dedup-titles.txt` (one title per line).
**Daily mode**: handled centrally in `sections/daily-mode.md` Step 3 — never judge manually.
**Single / URL / Batch mode**:
Copying the full parent environment into a subprocess that is also given authentication cookies increases the blast radius of that child process and any dependency it loads. In this skill, the subprocess is an external twitter CLI and the script also auto-discovers a proxy, so unnecessary inherited secrets such as API keys, tokens, and credentials may be exposed to third-party code or transmitted over attacker-controlled networking paths.
return []
# 3. 逐账号抓取
env = os.environ.copy()
env["TWITTER_AUTH_TOKEN"] = auth_token
env["TWITTER_CT0"] = ct0
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
read -r -p "版本号 [$NEXT]: " INPUT
VERSION="${INPUT:-$NEXT}"
# ── Update SKILL.md version ──
sed -i '' "s/^version: .*/version: $VERSION/" SKILL.md
echo "SKILL.md → version: $VERSION"
The skill explicitly instructs fetch.py to read x.com cookies from the user's local Chrome profile and pass them to a subprocess for authenticated Twitter/X access. Even if the stated purpose is limited and in-memory, browser cookie extraction is a sensitive credential-handling pattern: compromise of the subprocess, logs, environment leakage, or misuse of the fetched code path could expose session tokens and enable account hijacking.
andled by fetch.py.
| Source type | Fetched by | Notes |
|-------------|-----------|-------|
| `type: rss` | fetch.py (Step 1) | Done |
| `type: webfetch`, `python_fetch: true` | fetch.py (Step 1) | Done, `content` field populated |
| `type: webfetch`, `python_fetch: false` (Product Hunt) | Claude `WebFetch` | Cloudflare — must use WebFetch |
| `type: twitter` | fetch.py (Step 1) | Reads x.com cookies from local Chrome, auto-detects proxy |
| `type: tavily` | Claude Tavily search | Reddit etc. |
Skip a source on failure — do not block on it. **Use dates in article titles, body text, or page ordering to determine whether an article falls within the cutoff date; skip old articles immediately.**
**Do NOT pre-filter by topic or relevance.** Add all items from each source that pass the date cutoff — even if they seem unrelated to AI. The scoring system handles ranking. Every item from Product Hunt, GitHub Trending, etc. goes into pending regardless of whether it looks relevant.
**
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
**Action tag display rules:**
- `🎯 **TRY**` — article contains a GitHub repo / runnable code / dataset
- `🎯 **READ**` — deep content worth reading in full
- `🎯 **SCAN**` — news brief or low-score item, a quick skim is enough
The README instructs users to invoke the skill by saying daily, and later lists daily as a usage trigger. As a standalone common word, this is an ambiguous activation phrase that could easily occur in normal conversation and lacks constraints or negative examples clarifying when the skill should or should not activate.
The skill persists user profile data and history under ~/.ai-capsule/, creating session state that survives across runs and updates. While persistence is expected for this product, storing preferences, reading history, and scored article history can expose behavioral data or be reused by later runs without fresh consent, especially in multi-user or less isolated environments.
---
Claude will walk you through a short setup (role, familiar areas, output language) and write your config to `~/.ai-capsule/config.yaml`. Your data lives in `~/.ai-capsule/data/` — separate from the skill, safe across updates.
---
README 将“然后说 daily”描述为调用方式，但 daily 是常见英文词，单独作为触发词容易与普通对话或其他工作流发生碰撞。文档未提供触发上下文限制、精确命令前缀，或不会触发的反例说明，因此存在意外激活风险。
文档说明“在 OpenClaw 会话中说 daily”即可触发，但未说明更细的约束条件或排除条件。由于该短语过于简短且通用，容易与自然会话中的普通表达重叠，造成非预期调用。
“daily 或 每日模式”“粘贴 URL”“粘贴文章正文”等触发描述较为宽泛，且没有说明何时应触发、何时不应触发。尤其“粘贴 URL/文章正文”可能覆盖用户普通分享内容的场景，缺少约束会增加误调用概率。
The skill explicitly instructs use of shell, file reads/writes, environment variables, and network access, but does not declare any tool scope or allowed-tools boundary. That creates an overly broad execution surface where a host agent may grant more capabilities than users expect, increasing the chance of unintended local file access, persistence, or network actions.
The skill intentionally persists user configuration and history across sessions in the home directory, creating durable state about interests, role, language, and reading history. Persistent state is not inherently malicious, but it increases privacy risk and can influence future agent behavior in ways users may not expect if not clearly disclosed and controlled.
After collecting answers, write the config:
mkdir -p ~/.ai-capsule
cat > "${AI_CAPSULE_CONFIG:-$HOME/.ai-capsule/config.yaml}" << 'EOF'
The setup flow writes personally descriptive profile data, preferences, and storage paths into a persistent config file under the user's home directory without an explicit privacy/safety warning. Persisting this data can expose user profiling details to other local processes, backups, or future agent runs without the user realizing it.
Daily mode can trigger behavior that reads local Chrome x.com cookies and invokes an external twitter-related subprocess, yet the operational step only says to execute another file and does not prominently warn the user at the point of action. Access to browser cookies and external tooling is sensitive because it can expose authenticated session material and broaden the trust boundary beyond the skill itself.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
import socket
for port in ["7890", "6152", "1080", "1087"]:
try:
s = socket.create_connection(("127.0.0.1", int(port)), timeout=0.3)
s.close()
proxy = f"http://127.0.0.1:{port}"
print(f" [INFO] 检测到本地代理: {proxy}", file=sys.stderr)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(f" X/Twitter @{handle}...")
try:
# 多拉一些确保时间过滤后还能拿到目标条数
result = subprocess.run(
[_twitter_bin, "user-posts", f"@{handle}", "--max", "20"],
capture_output=True, text=True, timeout=20, env=env
)
This shell script presents its interactive prompts and status output entirely in Chinese, including the confirmation gate and cancellation messaging. That imposes a specific language on users without offering a choice or documenting a justified locale restriction, which matches the language/locale policy violation criteria.
The instructions direct the agent to append to history/dedup files and delete pending.json in the user's local data directory without an explicit warning or confirmation step. Even though these are expected application state files, silent modification and deletion of user-local data can cause unintended data loss, make recovery harder, and violate least-surprise expectations for an agent skill.
The URL parameter spoken_language_code=en imposes an English-language locale constraint in the skill configuration. This is a natural-language policy concern because the file does not indicate user opt-in, alternative locale selection, or a region-specific justification for forcing English.
The request headers hard-code Accept-Language: en-US,en;q=0.5, which imposes a specific language/locale preference for fetched content. This is a natural-language policy concern because the skill does not offer a user choice or explain why English is required.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.