AI前沿哨兵

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 2.1.0

Overview

This appears to be a legitimate public-news reporting skill, but it needs Review because it has under-scoped network access, insecure token persistence, broad local context loading, and mutable external install/execution paths.

Install only after reviewing and narrowing its access. Avoid entering Twitter tokens in the WebUI, pin installer/dependency/external-skill versions, keep custom RSS/web sources to trusted public URLs, and do not let the skill load broad USER.md or MEMORY.md files unless you have checked they contain no private or credential-like data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parsers/blog_rss.py:67

Finding

Server-Side Request Forgery Through Configurable RSS and Web Sources

Content

View full analysis

Optional[str]: for attempt in range(self.RETRY_COUNT): try: response = self.session.get(url, timeout=self.TIMEOUT) response.raise_for_status() response.encoding = response.apparent_encoding or 'utf-8' return response.text ``` ```python url = source.get('url') if not url: continue items = parser.parse(url, source.get('name', '')) ``` ### Technical Analysis The RSS and web-news collectors accept URLs from source configuration and pass them directly to `requests.get` or `requests.Session.get`. They do not restrict URL schemes, destination hostnames, ports, resolved IP addresses, or redirect targets. The project contains a separate `safe_http.py` module with a domain allowlist, but the affected collectors bypass it. Moreover, `requests` follows redirects by default, so validating only the initial URL would not be sufficient. An attacker who can add or modify a source can cause the collector to issue requests from the host running the Skill. This can expose network resources that are inaccessible to the attacker directly, including: - Loopback services such as `127.0.0.1`. - Private network services. - Link-local and cloud metadata endpoints. - Administrative interfaces reachable from the collector. - Ser ...[truncated 1400 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: webui/app.js:389

Finding

Persistent DOM Cross-Site Scripting in Custom Sources and Keywords

Content

View full analysis

🔗 ${source.name}

${source.description || 'Custom RSS feed'}

Feed URL: ${truncateUrl(source.url)}

${source.tags && source.tags.length > 0 ? `

${source.tags.map(tag => `${tag}`).join('')}

` : ''} `; ``` ```javascript const name = document.getElementById('sourceName').value.trim(); const url = document.getElementById('sourceUrl').value.trim(); const description = document.getElementById('sourceDesc').value.trim(); const newSource = { id: 'custom-' + Date.now(), name: name, url: url, description: description || 'Custom RSS feed', enabled: true, count: 0, tags: [] }; state.sources.push(newSource); saveToStorage(); ``` ```javascript tag.innerHTML = ` ${keyword}

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: webui/app.js:220

Finding

Plaintext Persistence of the Twitter Bearer Token

Content

View full analysis

{ state.settings.twitterToken = e.target.value; }); ``` The setup guide also recommends a plaintext YAML configuration: ```yaml twitter: bearer_token: "YOUR_BEARER_TOKEN_HERE" ``` It alternatively presents another plaintext file: ```yaml twitter: bearer_token: "REAL_TOKEN" ``` ### Technical Analysis The WebUI places the Twitter bearer token inside the general application settings object and serializes the complete object into `localStorage`. Browser local storage is not a secret store: it is readable by every script executing under the same origin and persists after browser restart. This is particularly exploitable because the same WebUI contains confirmed persistent DOM XSS. A successful XSS payload can synchronously retrieve the token without needing to read the password input. The documentation also recommends storing tokens in plaintext YAML. It claims that `.gitignore` excludes the secret files and refers to a settings template, bu ...[truncated 1639 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:298

Finding

Mutable and Unverified Third-Party Dependency Execution

Content

View full analysis

/dev/null ``` ### Technical Analysis The installation instructions use the mutable `latest` tag for the ClawHub command and install Python dependencies without exact versions or hashes. Repeating installation at different times can therefore retrieve different code from the code that was originally audited. The Skill additionally directs the Agent to install a separate repository-backed component and run its Node.js script. No reviewed commit, package version, checksum, integrity metadata, or sandbox boundary is specified. Although no malicious dependency was identified in the audited artifact, these instructions create an unsafe supply-chain execution path. Any compromise of an upstream account, package release, registry, or external Skill can introduce arbitrary code after this project has been reviewed. Redirecting standard error to `/dev/null` further reduces visibility into unexpected behavior from the external script. ### Attack Path 1. An upstream package, mutable release tag, registry account, or external Skill is compromised or changed. 2. A user follows the documented installation steps or the Agent follows the Skill's integration instructions. 3. `npx ...@latest`, unpinned `pip install`, or the external Skill installation retrieves the changed component. 4. The external package's installation hooks or `prepare-digest.js` execute under the user's account. 5. Malicious code gains the shell, filesystem, and network privilege ...[truncated 584 chars]

Remediation

View remediation

/dev/null` so security-relevant failures and warnings remain visible. 10. Use a dependency update process that includes review, testing, and vulnerability scanning before version changes are accepted. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:71

Finding

Unrestricted Loading of General User Profile and Agent Memory Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (92)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes an end-user-facing AI/news monitoring and big-data insight capability, with triggers around AI资讯、论文追踪、开源项目追踪、晨报/晚报 and data-platform analysis. The actual code chunk only performs offline build/release tasks: selecting files to include, creating a ZIP package, generating a checksum file, and writing a verify.sh script. Although filenames in the package list reference parsers like arxiv, hackernews, and github_trending, this code does not itself fetch, analyze, summarize, or track any external information. Its primary purpose is software packaging and verification, which is materially different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个较全面的AI情报追踪与大数据洞察系统，但提供的代码块只包含 arXiv 论文解析器。它通过 requests 调用 arXiv API，并解析 XML 返回论文元数据，属于“论文追踪”的一个子能力。代码中没有看到新闻源抓取、AI动态聚合、开源项目追踪、晨报/晚报生成，亦没有任何与大数据洞察、数据治理、湖仓一体或厂商对标相关的实现。因此，虽然与“论文追踪”部分部分吻合，但整体声明与该代码块实际行为存在明显范围和主功能不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims a full dual-engine system for AI intelligence tracking and big-data industry insight, with user-facing functions like tracking AI dynamics, generating briefings, following papers/open-source projects, and analyzing enterprise data platforms. The actual code chunk is only a helper network client that safely fetches remote content from a small whitelist of domains. While such a module could support a larger AI news tracker, this code alone does not realize the declared primary purpose. The mismatch is therefore material: the implemented behavior is infrastructural and much narrower than the declared end-user functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code is narrowly scoped to collecting Twitter/X content using a Bearer Token. That is consistent with part of an AI news/intelligence tracking pipeline, but it does not match the full declared description of a 'dual-engine' system with both AI intelligence tracking and big-data industry insight capabilities. There is no logic related to big-data insights, data middle platform/lakehouse/governance analysis, or vendor comparisons such as Huawei/OPPO/vivo. There is also no report-generation behavior for morning/evening briefings in this chunk. Therefore, the code only partially supports the declared purpose and materially underdelivers relative to the described capabilities, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

代码与声明存在明显描述-行为不一致。声明描述的是一个较完整的AI情报追踪与大数据行业洞察系统，似乎应支持广泛的信息追踪、资讯汇总，甚至晨报/晚报生成，以及大数据平台相关洞察能力。但实际代码只实现了一个子功能：通过HTTP请求抓取网页，并用BeautifulSoup解析几个指定站点或通用HTML中的新闻链接、标题、日期和摘要。它没有看到任何论文追踪、开源项目追踪、科技新闻聚合、报告生成、分析引擎，尤其没有任何与“大数据洞察模块”相关的逻辑。因此，虽然代码与“AI资讯追踪”的一小部分相关，但远不能覆盖声明的主要能力范围，属于实质性能力夸大。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

描述强调的是情报追踪与洞察生成引擎，核心能力应是收集、追踪、整理AI与大数据行业动态，并产出情报报告。而该代码片段并不进行任何外部信息获取、追踪、分析汇总或报表生成；它仅对已存在的数据结构进行质量评估，并输出评分结果卡片。虽然‘报告质量评分’可能是整个系统的辅助组件，但从该代码本身看，其主要用途与声明的主要功能明显不同，且存在未声明的评分/评级能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

该代码与“AI情报追踪/晨报晚报”主方向部分一致：它确实提供信息源管理、关键词设置、采集按钮和报告生成功能，且信息源围绕GitHub、arXiv、Hacker News、Twitter和RSS，符合AI资讯/论文/开源项目追踪场景。但存在明显描述-行为不一致：一是声明中特别强调的“大数据洞察模块”完全没有对应实现；二是代码中的采集与报告生成大多依赖mockData和前端模拟流程，缺乏真实的情报追踪、行业洞察或分析引擎能力。因此，整体上属于部分匹配但存在实质性缺口，应判定为描述与实际行为不完全一致。

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/index.html (reported line 764)May include surrounding context.

html

<body>
    <div class="bg-gradient"></div>

    <!-- Hero Section -->
    <section class="hero">
        <div class="container">
            <div class="hero-badge">OpenClaw 技能</div>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_setup.md (reported line 67)May include surrounding context.

• 已认证：5000次/小时

如需更高配额：

1. 在 GitHub Settings 生成 Personal Access Token
2. 在请求时添加 Header：

python

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_setup.md (reported line 172)May include surrounding context.

bearer_token = os.environ.get("TWITTER_BEARER_TOKEN", "")

text

- 或创建 `config/secrets.yaml`（已加入.gitignore）：

```yaml
twitter:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_setup.md (reported line 185)May include surrounding context.

bearer_token = os.environ.get("TWITTER_BEARER_TOKEN", "")

text

- 或创建 `config/secrets.yaml`（已加入.gitignore）：

```yaml
twitter:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · reports/2026-04-10/xiaohongshu_report.md (reported line 50)May include surrounding context.

md

🔧 **kpjadhav94/python-for-embedded**
Python Language for Embedded Engineer...
⭐0 Stars | Python

🔧 **modern-python/spellchecks**
Python library for spell-checking text i...

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · reports/2026-04-10/xiaohongshu_report.md (reported line 54)May include surrounding context.

md

🔧 **kpjadhav94/python-for-embedded**
Python Language for Embedded Engineer...
⭐0 Stars | Python

🔧 **modern-python/spellchecks**
Python library for spell-checking text i...

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · webui/index.html (reported line 11)May include surrounding context.

html

</head>
<body>
    <div class="app">
        <!-- 侧边栏 -->
        <aside class="sidebar">
            <div class="logo">
                <span class="logo-icon">⌘</span>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · webui/index.html (reported line 207)May include surrounding context.

html

</div>
                </div>
                
                <!-- ==================== 配置视图 ==================== -->
                <div class="view" id="settingsView">
                    <div class="settings-group">
                        <h3>API配置</h3>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub@latest install ai-intelligence-sentinel, which fetches and executes the latest CLI code at install time without version pinning. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users may execute attacker-controlled code directly from the installation instructions. The presence of the README's self-attesting security statement does not reduce risk and is mildly suspicious in context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install ai-intelligence-sentinel, which pulls and executes the latest remote package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or one of its transitive dependencies is compromised, users may execute untrusted code directly from the network.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The one-click install section again recommends npx clawhub@latest install ai-intelligence-sentinel, causing execution of the newest remote package without version pinning. Repeating this pattern increases the chance that users will follow unsafe installation instructions and be exposed to package takeover or malicious update scenarios.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The file documents outbound HTTP requests to external services, including one plain-HTTP endpoint (arXiv) and additional scraping/user-configured sources. In an agent skill, external transmission increases attack surface through metadata leakage, untrusted content ingestion, SSRF-like misuse via configurable feeds, and dependence on remote endpoints outside the developer's control.

Content

Scanner excerpt · SECURITY_REPORT.md (reported line 14)May include surrounding context.

md

| 序号 | 模块 | 调用的API/URL | 用途 | 认证方式 | 风险评估 |
|------|------|---------------|------|----------|----------|
| 1 | github_trending.py | `https://api.github.com/search/repositories` | 获取GitHub热门仓库 | 无(公开API) | ✅ 低风险 |
| 2 | github_trending.py | `https://github.com/trending/python` | 备用爬取方案 | 无 | ⚠️ 中风险 |
| 3 | arxiv.py | `http://export.arxiv.org/api/query` | 获取学术论文 | 无(公开API) | ✅ 低风险 |
| 4 | hackernews.py | `https://hacker-news.firebaseio.com/v0` | 获取HackerNews热门 | 无(公开API) | ✅ 低风险 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This section confirms the skill reaches multiple external destinations, including authenticated Twitter/X access plus user-configurable RSS and scraped webpages. In this skill context, the danger is not the existence of network use alone, but the combination of authenticated requests and flexible remote sources, which can expose tokens, leak usage patterns, or ingest malicious remote content if not tightly controlled.

Content

Scanner excerpt · SECURITY_REPORT.md (reported line 18)May include surrounding context.

md

| 2 | github_trending.py | `https://github.com/trending/python` | 备用爬取方案 | 无 | ⚠️ 中风险 |
| 3 | arxiv.py | `http://export.arxiv.org/api/query` | 获取学术论文 | 无(公开API) | ✅ 低风险 |
| 4 | hackernews.py | `https://hacker-news.firebaseio.com/v0` | 获取HackerNews热门 | 无(公开API) | ✅ 低风险 |
| 5 | twitter_x.py | `https://api.twitter.com/2/` | 获取Twitter推文 | Bearer Token | ✅ 低风险 |
| 6 | blog_rss.py | 用户配置的RSS源 | 订阅博客/新闻RSS | 无 | ⚠️ 可控风险 |
| 7 | web_news.py | 智谱AI/MiniMax等网页 | 解析中国AI公司动态 | 无 | ⚠️ 可控风险 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The documented Twitter/X API usage includes Bearer token authentication for outbound requests. In an agent skill, authenticated external calls raise the stakes because token mishandling, overbroad scopes, or accidental reuse with other fetch paths could enable unauthorized access or leak secrets through logs, errors, or misrouting.

Content

Scanner excerpt · SECURITY_REPORT.md (reported line 60)May include surrounding context.

4. Twitter/X API ✅ 安全

python

# twitter_x.py
url = f"https://api.twitter.com/2/users/by/username/{username}"
headers = {"Authorization": f"Bearer {bearer_token}"}

• Twitter官方API v2

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report makes a blanket safety claim that all outbound integrations are official public APIs, but earlier sections explicitly include non-API scraping targets and arbitrary user-configured RSS sources. This kind of contradictory security documentation can mislead reviewers and operators into underestimating exposure from scraping and untrusted remote content, weakening controls around network access and content handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares powerful tools (shell, filesystem, http) but does not constrain them with an explicit permission or allowed-tools scope. That increases blast radius if the skill is triggered unexpectedly or if later instructions/scripts cause broader file or command access than users anticipate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill name, description, templates, and usage instructions are all written to operate in Chinese and target specific Chinese-language report formats, but the file does not state that this is optional or user-selectable. This can amount to a language-policy violation because the skill implicitly forces one language/locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api_setup.md:144

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/sources_guide.md:176

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/parsers/twitter_x.py:27

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/parsers/safe_http.py:127