ClawHub
Back to skill

Security audit

Ai Capsule

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent AI news digest tool, but its default daily run reads local Chrome X/Twitter session cookies and passes them to a subprocess without a clear per-run opt-in.

Install only if you are comfortable with a daily news skill using your logged-in Chrome x.com session to fetch posts. Review the X/Twitter source list first, consider removing or disabling that source if you do not want cookie access, and be aware that cookies are passed to twitter-cli along with the process environment and any detected local proxy settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs use of shell, network access, environment variables, and local file read/write, yet no explicit permissions are declared. This creates a consent and transparency gap: an agent or user may invoke a skill that can access local config files, browser-derived credentials, and persistent storage without an upfront permission model.

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding
The documented purpose is news ranking, but the skill also exposes repository-modifying and publishing workflows plus source-configuration mutation. That mismatch broadens the effective attack surface: a user expecting a read-mostly digest tool could be induced into running commands that alter local files or publish content remotely.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrase "daily" is extremely broad and likely to appear in normal conversation, increasing the chance of unintended skill activation. In an agent environment that can fetch remote content, read local configuration, access browser-derived X/Twitter cookies indirectly via its tooling, and write persistent local state, accidental invocation expands the attack surface and may cause network actions or local data access the user did not intend.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The usage section advertises "daily" as a standalone activation phrase without constraints, examples of safe/non-safe invocation, or explicit confirmation requirements. Because this skill performs external fetching and maintains local persistent data, ambiguous invocation can lead to unintended execution, including network requests and updates to history/dedup files.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The README instructs users to invoke the skill with the single word "daily", which is a highly generic phrase that can easily appear in ordinary conversation. In an agent runtime that auto-matches skills from natural-language input, this broad trigger can cause unintended activation, leading the skill to fetch external content, read local browser cookies for x.com, probe localhost proxy ports, and write local state without the user explicitly intending to run this skill.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The invocation table documents "daily" and its Chinese equivalent as standalone activation phrases, again without boundaries or exclusion conditions. Given this skill's capabilities, accidental invocation is more concerning than a typical read-only skill because execution may trigger network access, subprocess execution, local proxy auto-detection, and access to x.com cookies from the local Chrome profile.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs reading local Chrome x.com cookies and invoking a Twitter-fetch subprocess, but that sensitive behavior is easy to miss in operational steps. Access to browser cookies can expose authenticated session material, making this far more sensitive than ordinary web fetching, especially when combined with subprocess execution and optional proxy use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads authentication cookies from the user's local Chrome profile and forwards them to a subprocess, enabling use of an active X/Twitter session without an explicit just-in-time consent prompt. In this skill's context, that is especially sensitive because browser cookies are high-value credentials and delegating them to another tool expands the trust boundary.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
Dedup file: `{data_dir}/dedup-titles.txt` (one title per line).

**Daily mode**: handled centrally in `sections/daily-mode.md` Step 3 — never judge manually.

**Single / URL / Batch mode**:
Confidence
85% confidence
Finding
never judge

Env Variable Harvesting

High
Category
Data Exfiltration
Content
return []

    # 3. 逐账号抓取
    env = os.environ.copy()
    env["TWITTER_AUTH_TOKEN"] = auth_token
    env["TWITTER_CT0"] = ct0
Confidence
89% confidence
Finding
os.environ.copy()

Unvalidated Output Injection

High
Category
Output Handling
Content
print(f"  X/Twitter @{handle}...")
            try:
                # 多拉一些确保时间过滤后还能拿到目标条数
                result = subprocess.run(
                    [_twitter_bin, "user-posts", f"@{handle}", "--max", "20"],
                    capture_output=True, text=True, timeout=20, env=env
                )
Confidence
95% confidence
Finding
subprocess.run( [_twitter_bin, "user-posts", f"@{handle}", "--max", "20"], capture_output

Self-Modification

High
Category
Rogue Agent
Content
read -r -p "版本号 [$NEXT]: " INPUT
VERSION="${INPUT:-$NEXT}"

# ── Update SKILL.md version ──
sed -i '' "s/^version: .*/version: $VERSION/" SKILL.md
echo "SKILL.md → version: $VERSION"
Confidence
85% confidence
Finding
Update SKILL

Known Vulnerable Dependency: requests==2.32.4 — 1 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
95% confidence
Finding
requests==2.32.4

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
| `type: rss` | fetch.py (Step 1) | Done |
| `type: webfetch`, `python_fetch: true` | fetch.py (Step 1) | Done, `content` field populated |
| `type: webfetch`, `python_fetch: false` (Product Hunt) | Claude `WebFetch` | Cloudflare — must use WebFetch |
| `type: twitter` | fetch.py (Step 1) | Reads x.com cookies from local Chrome, auto-detects proxy |
| `type: tavily` | Claude Tavily search | Reddit etc. |

Skip a source on failure — do not block on it. **Use dates in article titles, body text, or page ordering to determine whether an article falls within the cutoff date; skip old articles immediately.**
Confidence
93% confidence
Finding
cookies from local Chrome; cookies from local Chrome

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.