ClawHub
Back to skill

Security audit

ZAKER category news 行业热门新闻

Security checks for vulnerabilities and agentic risk

Overview

This skill is a category-news fetcher that makes a disclosed unauthenticated request to a fixed ZAKER news endpoint, with no evidence of credential access, persistence, destructive behavior, or hidden control.

Install this if you are comfortable with the agent contacting the disclosed ZAKER news API for category news. Treat ambiguous prompts as something the agent should clarify, and prefer adding request timeouts before using the sample Python script in production.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/get_category.py:23
Finding

Unbounded HTTP Request and Response Handling

Content
View full analysis

Vulnerability Details

File Location: scripts/get_category.py, lines 23–26
Vulnerability Type: Missing network timeout and response-size limit
Risk Level: Low

Vulnerable Code

python
response = requests.get(url, params=params)
response.raise_for_status()

result = response.json()

Technical Analysis

The HTTP request does not define connection or read timeouts. Consequently, the process can remain blocked indefinitely if the remote server accepts the connection but responds very slowly or never completes its response.

The response is also loaded and decoded as JSON without enforcing a maximum body size. A compromised, malicious, or malfunctioning endpoint could return an excessively large response and cause substantial memory consumption. Although HTTP request errors are handled elsewhere in the function, the implementation does not validate response size or fully validate the decoded response structure before processing it.

Attack Path

  1. An attacker compromises the configured skills.myzaker.com service or gains an equivalent ability to influence its responses.
  2. The skill sends its normal category-news request to the configured endpoint.
  3. The attacker either keeps the response open without completing it or sends an excessively large JSON body.
  4. Because no timeout or response-size boundary is configured, the process remains blocked or consumes excessive memory.
  5. The skill invocation becomes unavailable and, under severe memory pressure, the hosting process may terminate.

Impact Assessment

The issue affects availability of the skill and potentially the process hosting it. Successful exploitation may cause an indefinitely stalled invocation, resource exhaustion, or process termination.

The flaw does not grant additional system privileges, provide access to credentials, or directly enable arbitrary code execution. Exploitation depends on control of, or interference w ...[truncated 59 chars]

Remediation
View remediation

Remediation Suggestions

  • Configure explicit connection and read timeouts, for example:

    python
    response = requests.get(
    url,
    params=params,
    timeout=(5, 15),
    stream=True,
)

  • Read the response incrementally and reject it once a reasonable maximum size is exceeded.

  • Check Content-Type before attempting JSON decoding.

  • Catch response-decoding and schema-validation failures and return a controlled error.

  • Validate that result is an object, stat has the expected type, data is an object, and list is an array before iterating over articles.

  • Consider bounded retries with exponential backoff for transient failures; retries must retain strict per-request and overall time limits.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill documents external network access and even includes executable Python and shell examples, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates a governance gap where an agent may invoke broader capabilities than reviewers or policy expect, increasing the chance of unintended tool use or unsafe execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Examples such as follow-up or comparison phrases ('还有别的行业吗', '换个领域看看', 'More tech-related news') are context-dependent and may be interpreted too broadly outside a clear news session. If matched loosely, the skill could be invoked for ordinary conversation turns, causing unnecessary external fetches and reducing agent reliability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly says weak category expressions like 'AI 最近怎么样' or '汽车行业发展如何' should be prioritized as news requests, even when the user did not ask for news. That broad trigger logic can cause unintended invocation, leak user intent into an external request, and override safer or more appropriate general-answer behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.