ClawHub
Back to skill

Security audit

AI全链路科技资讯工厂

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly meant to automate AI news content production, but it includes public posting and recurring scheduled runs without enough confirmation or rollback controls.

Review carefully before installing. Treat the full workflow as capable of posting publicly and running repeatedly on a schedule; use it only with explicit review before publication, restricted publishing accounts, a user-scoped output directory, and a clear way to disable any cron job.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:115
Finding

Recurring Cross-Session Agent Task Creates System Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 115-123
Vulnerability Type: Scheduled-task persistence
Risk Level: Critical

Vulnerable Code

bash
# 每日 08:00 UTC 执行完整流水线
cron add --name "AI科技资讯工厂" \
  --schedule "cron:0 8 * * *" \
  --sessionTarget isolated \
  --payload '{"kind":"agentTurn","message":"执行 ai-tech-news-factory 完整流水线，保存到 /root/articles/{date}/"}'

Technical Analysis

The documented command registers a recurring cron task that survives the current Skill invocation and starts a new isolated Agent session every day. The scheduled payload executes the complete workflow rather than merely generating a reminder.

The workflow includes remote content retrieval, filesystem writes, image and article generation, and potentially authenticated publication to Xiaohongshu. Consequently, running the documented setup command changes persistent system state and allows later activity without a new explicit invocation from the user. The recurring schedule is also represented in workflow.json at lines 124-132.

The project does not include the implementations of the invoked Skills, so the behavior and permission boundaries of each scheduled downstream component cannot be verified within this audit.

Attack Path

  1. A user follows the scheduling instructions in SKILL.md.
  2. The cron add command creates a persistent daily task.
  3. At 08:00 UTC, the scheduler starts an isolated Agent session without a fresh user request.
  4. The Agent executes the full ai-tech-news-factory pipeline.
  5. Downstream Skills retrieve external content, write under /root/articles/{date}/, and may use configured authenticated sessions to publish content.
  6. The process repeats every day until the cron entry is explicitly removed.

Impact Assessment

The scheduled task obtains the effective privileges granted to the OpenClaw scheduler and the downstream Skills. Its scope can include:

  • Recurring filesystem writes under /root/articles/.

...[truncated 416 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic or copy-and-run cron registration from the primary usage instructions.
  2. Require explicit user invocation for every complete pipeline run.
  3. If scheduling is necessary, require a separate, informed opt-in confirmation that clearly lists the recurring network, filesystem, and publication actions.
  4. Separate content generation from publication. Require human approval immediately before every external post.
  5. Run the scheduled process under a dedicated least-privilege account with narrowly scoped filesystem and network permissions.
  6. Use restricted publishing credentials that cannot access unrelated account functions.
  7. Add execution limits, failure thresholds, audit logs, and notifications for every scheduled run.
  8. Document commands for listing, disabling, and permanently removing the cron entry.
  9. Expire schedules automatically after a short defined period unless the user explicitly renews them.

T08 · Insecure Dependencies

Warning
Location
README.md:73
Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: README.md, line 73
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
clawhub install rss-ai-reader

Technical Analysis

The installation command resolves rss-ai-reader by a mutable registry name without specifying an immutable version, package digest, verified publisher identity, or integrity checksum. The dependency's source code is not included in the audited project, so its implementation and transitive dependencies could not be reviewed.

A future registry update, publisher compromise, package-name takeover, or compromised transitive dependency could alter what is installed while the documented command remains unchanged. The workflow subsequently invokes this component to retrieve remote content and generate data consumed by later content-generation and publication stages.

Attack Path

  1. An attacker compromises the package publisher, registry entry, or a transitive dependency associated with rss-ai-reader.
  2. The attacker publishes a modified package under the same mutable package name.
  3. A user follows the README and executes clawhub install rss-ai-reader.
  4. The package manager resolves and installs the attacker-controlled version.
  5. The workflow invokes the compromised Skill during the RSS collection stage.
  6. Malicious behavior executes with the permissions available to the Agent and may manipulate content passed into downstream publishing stages.

Impact Assessment

A compromised dependency could potentially exercise the permissions granted to the installed Skill, including:

  • Reading or modifying files accessible to the Agent.
  • Making outbound network requests.
  • Manipulating RSS summaries and downstream generated content.
  • Supplying attacker-controlled material to publication components.
  • Accessing environment data or credentials if those resources are exposed to the Skill runtime.

The exact obtainable ...[truncated 141 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin rss-ai-reader to a reviewed immutable version or content digest.
  2. Record and verify an integrity checksum before installation.
  3. Verify and document the expected publisher identity and package provenance.
  4. Review the dependency source and all transitive dependencies before deployment.
  5. Generate and retain a dependency lock file or equivalent reproducible-install manifest.
  6. Run the dependency in a sandbox with minimal filesystem, network, environment, and credential access.
  7. Prevent the RSS collection component from directly accessing social-platform credentials.
  8. Require human review of generated content before any downstream publication.
  9. Establish a controlled update process that re-audits dependency changes before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises one-click multi-platform publishing and saving outputs to /root/articles without clearly warning users that it may post externally and write local files. This is dangerous because users may intend only to draft or summarize content, yet the orchestrated flow includes high-impact side effects like publishing to Xiaohongshu and WeChat and writing into privileged-looking paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The cron example sets up recurring autonomous execution that can generate content, write files, and publish on a schedule, but no warning or approval checkpoint is presented. Scheduled automation amplifies risk because a single setup action can cause repeated unintended posts, persistent filesystem changes, and ongoing misuse of authenticated sessions or cookies.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes automatic multi-platform publication to XiaoHongShu and WeChat plus writes to /root/articles/{date}/, yet it provides no explicit warning that the workflow can post externally or persist generated content to disk. Because the pipeline also includes a cron suggestion and direct publishing skills, a user or orchestrator could trigger real-world external actions without sufficiently informed consent, leading to unauthorized posting, reputational harm, or unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly describes one-click publishing to Xiaohongshu as part of an automated pipeline, but it provides no mention of user confirmation, dry-run mode, or safeguards before performing an external posting action. In an agent skill context, undocumented autonomous publication can cause unintended public posts, reputational harm, or disclosure of draft/generated content if a user triggers the workflow without realizing it includes live publishing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are broad everyday requests such as AI news, daily updates, and writing help, which makes accidental invocation likely in normal user conversations. In this skill, accidental activation is more dangerous because the documented workflow can cascade into content generation, file writes, and publishing actions across external platforms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow explicitly advertises a 'one-click' end-to-end pipeline that includes content generation and publishing, but it does not define any activation boundaries such as manual approval steps, environment restrictions, or confirmation gates before external actions occur. In a workflow that chains discovery, content generation, file writes, and social publishing, this ambiguity increases the risk of unintended autonomous posting or execution beyond what a user expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README content, including usage instructions and operational details, is entirely in Chinese and does not offer an alternative language or indicate that the user can choose their preferred language. This can be a language/locale policy issue under the stated rule when a specific language is effectively forced without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.