ClawHub
Back to skill

Security audit

Feedship

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent RSS/feed-management skill, but its install and upgrade instructions rely on mutable or unpinned remote Python code and persistent scheduled fetching, so users should review it before installing.

Install only from a trusted, pinned feedship release if possible. Avoid the GitHub latest-commits upgrade and mirror trusted-host path unless you understand the supply-chain tradeoff. Enable scheduled fetching only after confirming that periodic network access and local article/embedding storage are acceptable.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:21
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:21
Vulnerability Type: Unpinned third-party packages and transitive dependencies
Risk Level: High

Vulnerable Code:

bash
uv tool install 'feedship[ml,cloudflare]' --python 3.12 --force

Technical Analysis

The setup instruction installs the latest compatible version of feedship together with the ml and cloudflare optional dependency sets. Neither the direct package nor its transitive dependencies are pinned to reviewed versions or verified with cryptographic hashes.

Because Python packages may execute code during installation and at runtime, compromise of the package, one of its dependencies, or the package registry could result in arbitrary code execution. The --force option increases the risk by replacing an existing installation without first establishing that the replacement is trusted.

This behavior exceeds minimum privilege expectations for basic feed management because it installs large ML and browser-scraping dependency trees by default, even though those components are only needed for optional semantic-search and enhanced-scraping functionality.

Attack Path

  1. An attacker compromises the feedship package, a transitive dependency, or a package-registry account.
  2. The attacker publishes a malicious release that remains compatible with the unconstrained dependency specification.
  3. An Agent or user follows the documented installation command.
  4. uv resolves and downloads the malicious package version.
  5. Malicious installation hooks or imported runtime code execute with the privileges of the user running the command.
  6. The malicious code can access files, credentials, network resources, and application data available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include the user's files, environment var ...[truncated 213 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin feedship and all transitive dependencies to reviewed versions.
  • Maintain a lockfile and require cryptographic hashes for downloaded distributions.
  • Separate the base installation from optional ML and scraping extras so that users install only capabilities required for their task.
  • Remove --force from the default installation procedure.
  • Verify package provenance, release signatures, maintainers, and published artifacts before installation.
  • Perform installation in an isolated environment with restricted filesystem and credential access.
  • Use automated dependency scanning and controlled update review before changing pinned versions.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:45
Finding

Installation from a Mutable Git Repository and Relaxed Package Source Trust

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-47
Vulnerability Type: Mutable remote source and insecure dependency retrieval configuration
Risk Level: High

Vulnerable Code:

bash
uv tool install 'feedship @ git+https://github.com/yanpeipan/feedship.git' \
  --pip-args='-i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com' \
  --include-deps --force

Technical Analysis

This command installs executable Python code from the repository's mutable default branch rather than from an immutable, reviewed commit. Consequently, the code ultimately executed can change after the Skill has been audited without any modification to SKILL.md.

The command also installs unpinned transitive dependencies from an alternate package mirror. The --trusted-host option weakens normal package-source transport verification expectations, while --include-deps expands the remotely controlled dependency surface. The use of --force can overwrite a previously installed version.

Together, these behaviors create a remote payload and supply-chain execution channel: compromise of the repository, maintainer account, mirror, or dependency publication process could cause subsequent installations to execute attacker-controlled code.

Attack Path

  1. An attacker compromises the upstream GitHub repository, a maintainer account, the configured package mirror, or a required dependency.
  2. The attacker places malicious code on the repository's default branch or publishes/substitutes a malicious dependency.
  3. An Agent or user runs the documented upgrade command.
  4. uv retrieves the current mutable repository contents and resolves dependencies through the specified mirror.
  5. The existing installation is forcibly replaced.
  6. Attacker-controlled installation hooks or runtime modules execute with the installing user's privileges.
  7. The payload may continue operating whenever the installed `fee ...[truncated 803 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the mutable Git reference with a reviewed, immutable commit SHA or a cryptographically signed release.
  • Verify the selected commit or release against an independently recorded digest or signature.
  • Pin all transitive dependencies and enforce artifact hashes through a lockfile.
  • Remove --trusted-host and preserve strict TLS certificate and hostname verification.
  • Use a trusted primary package index or an internally controlled mirror with artifact integrity verification.
  • Remove --force from routine upgrade instructions and require explicit review before replacing an installation.
  • Run source-based installations in a sandbox with minimal filesystem, credential, and network access.
  • Require code review and automated security scanning before advancing the approved commit or dependency versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

ol install 'feedship[ml,cloudflare]' --python 3.12 --force

text

> **Note:** `cloudflare` extra provides scrapling (HTML fetching); `ml` extra provides
> sentence-transformers + chromadb (semantic search). Both are required for full functionality.

### China / Restricted Networks

For environments where PyPI or HuggingFace is not accessible, use mirrors:

```bash
# Add to ~/.bashrc for persistence
echo 'export HF_ENDPOINT=https://hf-mirror.com' >> ~/.bashrc
echo 'export PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/' >> ~/.bashrc
source ~/.bashrc

# Install
uv tool install 'feedship[cloudflare,ml]' --force

Upgrade

bash
# From PyPI (if accessible)
uv tool upgrade feedship

# From GitHub (latest commits)
uv tool install 'feedship @ git+https://github.com/yanpeipan/feedship.git' \
  --pip-args='-i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com' \
  --include-deps --force

After installation, verify with: feedship --version

**First-tim

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

For environments where PyPI or HuggingFace is not accessible, use mirrors:

bash
# Add to ~/.bashrc for persistence
echo 'export HF_ENDPOINT=https://hf-mirror.com' >> ~/.bashrc
echo 'export PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/' >> ~/.bashrc
source ~/.bashrc

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

macOS (LaunchAgent):

xml
<!-- ~/Library/LaunchAgents/com.feedship.fetch.plist -->
<key>ProgramArguments</key><array><string>/usr/local/bin/feedship</string><string>fetch</string><string>--all</string></array>
<key>StartInterval</key><integer>3600</integer>  <!-- every hour -->

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

A locale/timezone is forced in the example command via --tz Asia/Shanghai, which is a natural-language policy concern because it imposes a specific regional setting without offering a choice. The file does not explain that this is merely an example or instruct users to replace it with their own timezone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file describes feedship fetch and later recommends cron/systemd/OpenClaw scheduling, but it does not explicitly warn that the command contacts remote feeds and persists fetched article data/embeddings locally. Because the skill affects privacy and system state through automated network access and local storage, a brief disclosure would improve user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.