ClawHub
Back to skill

Security audit

Yum NoteBook

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its stated notebook-generation purpose, but it deserves review because optional helper integrations can execute configured local programs or Python files and can send generated content to external services.

Install only if you are comfortable reviewing the config before use. Keep ai.provider, upload.provider, notify.webhook_url, and deliver.provider disabled for sensitive sources unless you explicitly want data sent out. Do not enable ai.cli.command, --fetcher, rclone/openclaw binaries, or onedrive_graph.uploader_path unless the referenced commands and files are trusted and protected from modification. Avoid using URL ingest on machines that can reach sensitive internal services.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
yumnb/cli.py:323
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
dict: import requests html, title = "", "" try: r = requests.get(url, timeout=20, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}) if r.status_code == 200: html = r.text except Exception as e: html = f"" if (not html or "" not in html.lower()) and fetcher: try: out = subprocess.run(fetcher.split() + [url], capture_output=True, text=True, encoding="utf-8", timeout=60) if out.returncode == 0 and out.stdout: html = out.stdout except Exception as e: print(f"fetcher fallback failed: {e}") ``` ### Technical Analysis The `ingest_url` function performs an HTTP request to a user-supplied URL without validating its destination. It does not reject loopback, private, link-local, reserved, or cloud metadata addresses. The `requests` library also follows redirects by default, and redirected destinations are not revalidated. Consequently, an untrusted user who can control the ingestion input can use the Skill's network position to request resources that are not directly reachable from the attacker's system. Relevant targets include: - Loopback services such as `127.0.0.1` - Private network services in RFC 1918 address ranges - Link-local services and cloud metadata endpoints - Internal administration interfaces - Public hosts that redirect to private destinations - Hostnames affected by DNS rebinding A successful HTTP response is written into the generated notebook's `source/page.html` and extracted into `source/raw.txt`. If automatic summarization is enabled, up to 60,000 characters of the retrieved source are subsequently provid ...[truncated 1793 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
yumnb/upload.py:44
Finding

Configured External Python File Is Executed In-Process Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (39)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 212)May include surrounding context.

bash
python -m yumnb ingest "<URL>"
# read source/raw.txt, write summary.md and deck.json yourself
python -m yumnb tts notes/<slug>/talkshow.txt --output notes/<slug>/talkshow.mp3
python -m yumnb ppt notes/<slug>/deck.json --output notes/<slug>/deck.pptx
python -m yumnb publish notes/<slug>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises capabilities that involve filesystem access, shell execution, environment-variable use, and network activity, but it does not declare any explicit tool scope or permissions boundaries. For an agent-integrated skill that can ingest remote content, generate artifacts, and publish/upload them, this increases the chance of over-privileged execution and makes it harder for users or orchestrators to constrain sensitive actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include broad natural-language requests like 'summarize this link' and 'help me understand this article,' which are common across many benign conversations. In agent environments, this can cause the skill to activate unexpectedly, pulling in URLs or files and potentially initiating downstream processing, upload, or notification behaviors the user did not specifically intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that generated content may be uploaded to cloud providers or posted to Slack/Discord/Teams, but it does not present a strong, prominent warning that source material and derived artifacts can leave the local system. Because the skill processes URLs, YouTube content, screenshots, and raw text, accidental external transmission could expose sensitive documents, transcripts, images, or summaries to third parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.example.yaml (reported line 28)May include surrounding context.

yaml
openai:
    # api_key: ${OPENAI_API_KEY}        # or set env OPENAI_API_KEY
    model: gpt-4o-mini
    # base_url: https://api.openai.com/v1
    # base_url: http://localhost:11434/v1   # e.g. Ollama / LM Studio in OAI mode

  # ── anthropic ─────────────────────────────────────────────────────────

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · tests/test_smoke.py (reported line 13)May include surrounding context.

python
def run_cmd(args, cwd=None):
    env = dict(**__import__('os').environ)
    existing = env.get("PYTHONPATH", "")
    env["PYTHONPATH"] = str(ROOT) if not existing else f"{ROOT}:{existing}"
    return subprocess.run(

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_smoke.py (reported line 16)May include surrounding context.

python
env = dict(**__import__('os').environ)
    existing = env.get("PYTHONPATH", "")
    env["PYTHONPATH"] = str(ROOT) if not existing else f"{ROOT}:{existing}"
    return subprocess.run(
        RUNNER + args,
        cwd=cwd or ROOT,
        env=env,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The OpenAI/Anthropic/Gemini providers send system and user prompt content to third-party services, but this file contains no user-facing notice, consent flow, or data-sensitivity guard. For a tool that ingests local-first source material, this can silently exfiltrate private notes, screenshots, or extracted content to external providers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CLI provider allows arbitrary external executable invocation for a skill whose stated purpose is note-taking and summarization. Because prompt content is fed to stdin of any configured command, a dangerous or unexpected binary can be invoked through configuration, expanding the skill into a general command-execution bridge.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The CLI provider sends full prompt content to an arbitrary external command without any built-in warning or trust check. Even when the command is nominally an AI CLI, it may log, forward, or otherwise expose notebook contents, making silent data disclosure possible.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · yumnb/ai_provider.py (reported line 158)May include surrounding context.

python
def complete(self, system: str, user: str) -> str:
        prompt = f"<system>\n{system}\n</system>\n\n<user>\n{user}\n</user>\n"
        try:
            r = subprocess.run(self.cmd, input=prompt, capture_output=True,
                               text=True, encoding="utf-8", timeout=self.timeout)
        except subprocess.TimeoutExpired as e:
            raise AIError(f"CLI provider timed out after {self.timeout}s: {e}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill automatically performs outbound network requests to arbitrary URLs and stores the retrieved content locally without an execution-time warning or consent check. In a local-first note tool this can still expose the agent environment to attacker-chosen endpoints, enabling SSRF-like access patterns, internal service probing, or unexpected data transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The optional fetcher runs an external program without a clear safety warning, combining network retrieval with local process execution. Because the command is user/config supplied and can process attacker-controlled URLs, this materially increases the risk of code execution and unintended data exposure in agent environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The CLI accepts an arbitrary --fetcher string and executes it as a subprocess, allowing the caller to run any local program in the agent's environment. Even though shell=True is not used, this still grants broad code-execution capability unrelated to simple notebook ingestion and is especially risky in agent workflows where tool arguments may be influenced by untrusted content or indirect prompt injection.

Content

Scanner excerpt · yumnb/cli.py (reported line 335)May include surrounding context.

python
if (not html or "<title>" not in html.lower()) and fetcher:
        try:
            out = subprocess.run(fetcher.split() + [url], capture_output=True, text=True, encoding="utf-8", timeout=60)
            if out.returncode == 0 and out.stdout:
                html = out.stdout
        except Exception as e:

Ssd 1

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Untrusted source material is inserted directly into the LLM prompt without strong delimiting or instructions to treat it as data only. Malicious web pages, transcripts, or text can therefore inject instructions that manipulate the model's summary output, causing misleading content, policy bypass attempts, or downstream unsafe actions in later pipeline stages.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The talk-show stage reuses either the generated summary or raw source as prompt input, allowing prompt injection from the original source to persist and influence later outputs. This second-stage propagation can amplify malicious instructions and make contaminated model output seem more trustworthy because it appears in a polished derivative artifact.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The deck-planning prompt embeds source-derived content directly into a JSON-generation task, creating another prompt-injection path that can distort slide content or coerce malformed output. Because this stage influences a presentation artifact and may reference local image paths, poisoned content can cascade into downstream deliverables and sharing workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The publish flow can send note titles, summaries, and generated links to a configured webhook with no interactive warning at runtime. Since ingested content may be sensitive and this tool is advertised as local-first, silent external notification creates a meaningful risk of unintended data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The publish step may transmit files and text to an external delivery provider without an explicit warning, potentially exporting generated artifacts off-host. Because notes can contain fetched web content, transcripts, or user-provided material, this can leak sensitive data to third-party systems unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes a broader capability than its stated summarization/notebook purpose by permitting arbitrary external fetcher execution during ingest. In an agent setting, this expands the attack surface from content processing to local command execution, which can be abused for data exfiltration or host compromise if arguments are attacker-influenced.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

This subprocess invocation is not inherently unsafe by itself because it passes an argument list rather than a shell string, but in this file the command path and multiple arguments are built directly from user-configurable configuration values such as binary, channel, target, account, reply/thread identifiers, and message/media inputs. In the context of an agent skill that can ingest external content and deliver it to chat systems, this creates a real command-execution boundary where an attacker who can influence configuration or PATH resolution could cause execution of an unintended binary or abuse the trusted local messaging bridge to exfiltrate generated artifacts to arbitrary destinations.

Content

Scanner excerpt · yumnb/deliver.py (reported line 34)May include surrounding context.

python
def _run(cmd: List[str], timeout: int = 300) -> Tuple[int, str, str]:
    try:
        r = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yumnb/notify.py (reported line 84)May include surrounding context.

python
return None
    builder = _STYLES.get((style or "generic").lower(), _generic_payload)
    payload = builder(title, summary, links)
    r = requests.post(webhook_url, json=payload, timeout=20)
    print(f"webhook [{style}] -> {r.status_code}")
    return r.status_code

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · yumnb/tts.py (reported line 106)May include surrounding context.

python
def _wav_to_mp3(wav_path, mp3_path):
    subprocess.run([_ffmpeg(), "-y", "-i", wav_path, "-q:a", "2", mp3_path],
                   check=True, capture_output=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · yumnb/tts.py (reported line 116)May include surrounding context.

python
with open(list_path, "w", encoding="utf-8") as f:
        for p in input_files:
            f.write(f"file '{os.path.abspath(p).replace(chr(39), '_')}'\n")
    subprocess.run([
        _ffmpeg(), "-y", "-f", "concat", "-safe", "0", "-i", list_path,
        "-codec:a", "libmp3lame", "-b:a", "128k", "-ar", "44100", "-ac", "2",
        output_mp3,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

In dual-audio mode, arbitrary script text is sent to Microsoft's online edge-tts service, which can expose private, proprietary, or regulated content to an external provider without an explicit in-context warning or consent gate. Because this skill is designed to ingest articles, videos, screenshots, and generate artifacts for sharing, users may reasonably pass sensitive material, making silent exfiltration to a third party materially risky.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
yumnb/upload.py:62