Tech Weekly Briefing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:23 PM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it asks users to set up ongoing automatic runs and its behavior does not fully match its description.

Review this skill before installing. It is suitable only if you want a scheduled RSS briefing and are comfortable with recurring cron jobs, outbound feed requests, local article snapshots under the skill data directory, and reports/logs in /tmp. Avoid adding the cron entries unless you understand how to remove them, and expect Chinese-oriented output despite the preferred-language description.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:57

Finding

Persistent User-Level Execution Through Recurring Cron Jobs

Content

View full analysis

> /tmp/tech-weekly-cron.log 2>&1 ``` ```bash # Every Saturday at 09:00 Beijing Time 0 9 * * 6 cd ~/.openclaw/workspace-group/skills/tech-weekly-briefing && python3 scripts/generate-briefing.py weekly >> /tmp/tech-weekly-cron.log 2>&1 ``` ### Technical Analysis The documentation instructs the user to modify their crontab and install two recurring tasks. These jobs survive the original Skill session and execute the Python script daily and weekly without requiring further interaction. Scheduled collection is consistent with the Skill's advertised automation feature, and the cron entries do not request root privileges. Nevertheless, persistent scheduling exceeds the minimum lifetime and privileges required to generate an on-demand briefing. The documentation does not clearly present persistence as an optional security-sensitive action, obtain explicit informed consent, provide an uninstall procedure, or offer a nonpersistent default. The jobs execute code from a mutable workspace path. If another process or future package update can replace `scripts/generate-briefing.py` or files imported by it, the changed code will subsequently run automatically under the account that owns the crontab. The current audited script does not contain such a malicious payload, but the persistent execution mechanism expands the impact of later file compromise. ### Attack Path 1. A user follows the Skill documentation and opens `crontab -e`. 2. The user installs the documented daily and weekly cron entries. 3. The entries remain active after the initiating session ends. 4. Cron periodically runs cod ...[truncated 1343 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared behavior says the skill creates briefings in the user's preferred language, but the body mandates Chinese-only content for part of the output and also writes data and reports to local storage paths not disclosed in the description. This mismatch undermines informed consent and can cause an agent to take unexpected actions beyond the user's understanding.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared behavior says the skill creates briefings in the user's preferred language, but the body mandates Chinese-only content for part of the output and also writes data and reports to local storage paths not disclosed in the description. This mismatch undermines informed consent and can cause an agent to take unexpected actions beyond the user's understanding.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill includes a raw rm command using shell expansion to delete a file, which is a destructive operation executed through the shell. Even though the path is specific, normalizing destructive shell commands in skill instructions raises the risk of accidental data loss, misuse in automation, or unsafe adaptation to broader paths.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Force Re-fetch Today

bash

rm ~/.openclaw/workspace-group/skills/tech-weekly-briefing/data/articles_$(date +%Y-%m-%d).json
python3 scripts/generate-briefing.py daily

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of shell commands, filesystem reads/writes, cron persistence, and network access, but does not declare any explicit tool scope or permission boundaries. In an agent environment, this creates an over-privileged, under-specified skill that could perform side effects the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill instructs the operator to install cron jobs, creating persistence beyond the immediate user request. In an agent context, persistence is sensitive because it can cause recurring network access, file writes, and ongoing execution without a fresh authorization each time.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Cron Setup:

bash

# Add to crontab
crontab -e

# Add this line for daily fetch at 00:00:
0 0 * * * cd ~/.openclaw/workspace-group/skills/tech-weekly-briefing && python3 scripts/generate-briefing.py daily >> /tmp/tech-weekly-cron.log 2>&1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill specification requires "Overview - Chinese only" and later states "Language: Chinese only," which imposes a specific language regardless of user preference. This conflicts with the stated ability to create reports in the user's preferred language and represents a locale/language policy issue because no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

bash

# View today's collected articles
ls -la ~/.openclaw/workspace-group/skills/tech-weekly-briefing/data/

# Check article count
python3 -c "import json; data=json.load(open('data/articles_$(date +%Y-%m-%d).json')); print(f'{len(data)} articles today')"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The dataset materially diverges from the skill’s stated purpose of producing a weekly tech briefing from major tech media by including entertainment, shopping, lifestyle, product-review, and other non-tech content. This can be exploited to poison downstream summarization, dilute topic quality, and mislead users about source relevance and multi-source verification, especially if the agent assumes the fetched corpus is already trustworthy and in-scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest says the skill generates briefings from six named sources and filters for tech news, but this dataset shows mislabeled Verge items with blog set to The Information and includes clearly non-tech lifestyle/culture content such as music and concert-industry coverage. That indicates the implemented aggregation data does not reliably enforce the declared source boundaries or the promised low-quality/topic filtering.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest promises a curated weekly tech briefing with low-quality content filtering, but the stored WIRED entries include numerous shopping guides, wellness, bedding, bird feeders, coffee gear, posture correctors, and other consumer/lifestyle pieces that are not plausibly part of a focused tech-news briefing. This is a semantic mismatch between the claimed briefing curation/filtering behavior and the actual collected content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill generates weekly tech news briefings from six major tech media sources with low-quality filtering and interactive company-based navigation. However, this dataset's "Other" bucket contains numerous clearly off-scope items such as entertainment, consumer product reviews, health/science pieces, and general-interest articles, which indicates the actual content curation is substantially broader and less filtered than claimed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes RSS aggregation, deduplication, filtering, and report generation, which reasonably justifies network access and local storage. However, spawning an external command to impersonate a browser and bypass feed access restrictions is a materially broader capability than ordinary feed fetching and is not declared as part of the skill's scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate-briefing.py (reported line 100)May include surrounding context.

python

'-A', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            url
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=35)
        if result.returncode == 0:
            return result.stdout
        else:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code explicitly generates a Chinese summary and report sections, and labels the timestamp as Beijing time. This enforces a specific language and locale in the skill's natural-language behavior without any user opt-in or configurable language selection, which matches the policy-violation criteria for locale/language constraints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest claims a general weekly tech news briefing across six major outlets, with company navigation and multi-source hot-story detection. The code additionally carves out a special autonomous-driving vertical, including custom keywording, grouping, and a dedicated report section, which changes the product behavior beyond the described general briefing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup script provisions 10 media sources while the skill metadata claims coverage of 6 specific outlets. This scope mismatch can silently broaden data collection and output provenance, undermining user expectations, policy review, and trust boundaries; in an agent setting, undisclosed sources may introduce licensing, reliability, or content-governance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup-sources.py (reported line 25)May include surrounding context.

python

def add_blog(name: str, url: str):
    """Add a blog to blogwatcher."""
    try:
        result = subprocess.run(
            ["blogwatcher", "add", name, url],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup-sources.py (reported line 55)May include surrounding context.

python

# List current blogs
    print("\nCurrent blog list:")
    subprocess.run(["blogwatcher", "blogs"])
    
    return 0 if success_count > 0 else 1

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown instructs operators to run an rm command that deletes the current day's collected data file, but the section does not warn that this removes existing data before re-fetching. For markdown files, destructive or data-affecting behavior should be accompanied by a clear warning about impact on user data or recoverability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Multiple entries point to theverge.com while their metadata labels the blog as "The Information," creating a provenance integrity problem. Incorrect source attribution can break deduplication, source diversity checks, trust signals, and any logic that relies on publisher identity, allowing reports to falsely claim corroboration across distinct outlets when the underlying metadata is wrong.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Although Ars Technica is an allowed source, the stored items include entertainment trailers, dinosaur discoveries, ghost elephants, cemetery-moss forensics, and other general-interest pieces. That suggests the skill is aggregating source feeds wholesale rather than delivering the promised tech-focused curated briefing and filtering.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest claims aggregation from six named media sources, but some entries label The Verge URLs with blog set to "The Information" rather than the actual outlet. This means the stored data does not faithfully represent source attribution, which conflicts with the described multi-source aggregation and verification behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is an active documentation-versus-code mismatch: the function is described as translation-related, yet its implementation is a no-op. Because the manifest also advertises output in the user's preferred language, this misleading documentation obscures the fact that no translation is actually performed here.

Content

No source excerpt is available for this finding.