Skill Trust Decision
news-briefing
Undeclared shell execution and command injection risk with user-supplied topics flowing into execSync, despite transparent documentation in skill-card.md that acknowledges these risks.
Most direct threat evidence
High RCE
Command injection via user-supplied --topic The --topic argument (user-controlled) is interpolated directly into a shell command string passed to execSync. An attacker controlling the topic could inject arbitrary shell commands. This is partially mitigated by the tool being a personal briefing tool rather than a multi-tenant service, but the risk is real.
scripts/fetch-news.mjs:55 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
9 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
Command injection +25
User-supplied --topic flows into execSync shell string in fetch-news.mjs
Undeclared shell:WRITE +15
SKILL.md declares network:READ only, but execSync used in 3 of 4 scripts without mention
API keys in process args +10
Bearer tokens and secrets appear in curl command lines, visible in process listings
Temp file writes with hardcoded paths +5
gen-cover.mjs writes to /tmp/gen-cover.js and references internal OpenClaw paths
Positive: documented risks +-10
skill-card.md explicitly lists all three risk categories and recommends mitigations
Positive: native fetch used +-5
send-card.mjs correctly uses native fetch for Feishu API
Most important evidence
High RCE
Command injection via user-supplied --topic
The --topic argument (user-controlled) is interpolated directly into a shell command string passed to execSync. An attacker controlling the topic could inject arbitrary shell commands. This is partially mitigated by the tool being a personal briefing tool rather than a multi-tenant service, but the risk is real.
scripts/fetch-news.mjs:55 Replace execSync+curl with native fetch() or use execFile with array arguments to avoid shell interpretation.
High Doc Mismatch
Undeclared shell:WRITE capability
SKILL.md declares only network:READ (via WebFetch) but all scripts use execSync for shell execution. Shell:WRITE is a significantly more powerful and dangerous permission than declared.
scripts/fetch-news.mjs, scripts/news-digest.mjs:55 Document shell execution explicitly in SKILL.md or migrate to native fetch/execFile.
High Credential Theft
API keys visible in process argument list
Bearer tokens (PERPLEXITY_API_KEY, PPIO_API_KEY, FEISHU_APP_SECRET) are passed as curl command-line arguments, making them visible to anyone who can read /proc/<pid>/cmdline. This enables credential theft via local privilege escalation.
scripts/fetch-news.mjs:55 Use native fetch() with Authorization header set programmatically, not via CLI args.
Medium RCE
Dynamic code execution via execSync
gen-cover.mjs constructs a JS code string and executes it via execSync with hardcoded internal paths, plus writes to /tmp/gen-cover.js.
scripts/gen-cover.mjs:10 Prefer direct Node.js module imports or spawn with script files rather than eval-style execution.
Low Sensitive Access
Hardcoded internal OpenClaw paths
gen-cover.mjs references absolute internal paths like /root/.openclaw/workspace/skills/news-briefing/ and pnpm global store paths. This leaks internal infrastructure topology.
scripts/gen-cover.mjs:6 Use environment-aware or relative paths instead of hardcoded absolute paths.
Declared capability vs actual capability
Shell Block
Declared NONE
→ Inferred WRITE
fetch-news.mjs:55 curl via execSync; news-digest.mjs:72 node via execSync; send-card uses native fetch (compliant) Network Pass
Declared READ
→ Inferred READ
Perplexity API, PPIO API, Feishu API all declared in SKILL.md environment variables Filesystem Block
Declared NONE
→ Inferred WRITE
gen-cover.mjs:10 writeFileSync('/tmp/gen-cover.js'); fetch-news.mjs:10 writeFileSync for optional output-file Environment Pass
Declared NONE
→ Inferred READ
API keys read from process.env for shell injection Suspicious artifacts and egress
Medium External URL
https://openclaw.ai SKILL.md:138
Medium External URL
https://clawhub.com/u/derekhsu529 SKILL.md:138
Medium External URL
https://api.perplexity.ai/chat/completions scripts/fetch-news.mjs:65
Medium External URL
https://api.ppinfra.com/v3/openai/chat/completions scripts/fetch-news.mjs:122
Medium External URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal scripts/send-card.mjs:35
Medium External URL
https://www.google.com/search?q=$ scripts/send-card.mjs:84
Medium External URL
https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id scripts/send-card.mjs:140
Medium External URL
https://clawhub.ai/user/derekhsu529 skill-card.md:7
Medium External URL
https://clawhub.ai/derekhsu529/news-briefing skill-card.md:28
Dependencies and supply chain
There are no structured dependency warnings.
File composition
7 files · 912 lines
JavaScript 4 files · 723 linesMarkdown 2 files · 184 linesJSON 1 files · 5 lines
Files of concern · 5
scripts/fetch-news.mjs Command injection via user-supplied --topic · API keys visible in process argument list · https://api.perplexity.ai/chat/completions · https://api.ppinfra.com/v3/openai/chat/completions
scripts/gen-cover.mjs Dynamic code execution via execSync · Hardcoded internal OpenClaw paths
scripts/send-card.mjs https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal · https://www.google.com/search?q=$ · https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id
SKILL.md https://openclaw.ai · https://clawhub.com/u/derekhsu529
skill-card.md https://clawhub.ai/user/derekhsu529 · https://clawhub.ai/derekhsu529/news-briefing
Other files · news-digest.mjs · _meta.json
Security positives
skill-card.md explicitly documents all three risk categories (command injection, credential exposure, third-party API) with mitigations — highest-quality transparency signal
send-card.mjs correctly uses native fetch() for Feishu API, showing the skill author knows how to avoid shell execution
No base64-encoded payloads, no reverse shells, no C2 infrastructure, no exfiltration endpoints
No access to ~/.ssh, ~/.aws, .env or other sensitive credential paths beyond declared API keys
Credential usage is scoped to legitimate news delivery APIs (Perplexity, PPIO, Feishu) with no data exfiltration to unknown endpoints