Recent News Article Aggregator

• Outcome: Pass
• Latest audit: Jun 10, 2026 at 5:23 AM UTC
• Version:
  1.0.0

Overview

This is a documentation-only skill for calling an AgentPMT news search service, with no hidden local execution or persistence found.

Install only if you are comfortable using AgentPMT-hosted news search. Search topics, filters, and other parameters may be sent to AgentPMT and may consume credits, so avoid secrets, regulated data, private internal project names, or unnecessary sensitive context in queries.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation keywords and usage text are broad enough to match generic requests for research, writing, or up-to-date information, which can cause the skill to trigger in contexts the user did not explicitly intend. Because the skill performs remote news retrieval, overbroad activation increases the chance of unnecessary external calls and unintended disclosure of user queries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents authenticated REST/MCP calls to external AgentPMT services but does not clearly and prominently warn that search queries and parameters are transmitted off-platform. Users may provide sensitive topics, internal research terms, or proprietary entities without realizing that this data will be sent to a third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.