Security audit

News Aggregator Skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed public-news aggregator with expected web fetching and local report output, and no evidence of hidden credential use, exfiltration, destructive behavior, or privilege escalation.

Install only if you want a skill that contacts multiple public news sites and, in deep mode, follows article links to fetch page text. Expect Markdown reports to be written under reports/. For stronger hygiene, run it in a normal project sandbox and pin or review the Python dependencies before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill clearly directs use of a network-fetching script across multiple external sources, but no corresponding permissions are declared. This creates a transparency and policy gap: users and host systems may not realize the skill will make outbound requests, increasing the risk of unintended data exposure or unsafe execution in environments that rely on manifest-declared capabilities.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill requires persistent writing of generated reports to a local reports/ directory even though its stated purpose is news retrieval and summarization. Unnecessary file persistence expands the attack surface by leaving behind artifacts that may contain prompts, user interests, fetched content, or sensitive context on disk without a clear need.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The README presents the skill as a Chinese-language assistant and the advertised outputs and invocation examples are all Chinese, without indicating any language selection or opt-in. This can override user expectations and reduce accessibility, but it is primarily a UX/safety issue rather than a direct security exploit.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to save reports locally without warning the user that files will be created. Silent filesystem writes violate user expectations and can lead to privacy issues, storage misuse, or persistence of sensitive derived content that the user did not consent to retain.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests beautifulsoup4
Confidence: 98% confidence
Finding: requests

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests beautifulsoup4
Confidence: 94% confidence
Finding: beautifulsoup4

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: requests

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.