Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local-news research skill that uses a user-provided newsroom API key and has no hidden persistence, exfiltration, or destructive behavior.
Install only if you are comfortable giving the skill network access to the configured newsroom and using a cn_ API key. Prefer a read-only key, keep NEWS_SITE and PLATFORM_API_BASE in trusted configuration, and use --out only for files you intend to create or overwrite. Verify attribution and newsroom terms before republishing retrieved material.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never NEWS_SITE or PLATFORM_API_BASE):
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Although the skill markets itself as read-only with respect to the newsroom API, it can write local files via --out in cmd_brief. This is not remote compromise, but it is a real capability mismatch that could surprise a host agent or violate a least-privilege policy if file-write permission was not granted.
Although the skill markets itself as read-only with respect to the newsroom API, it can write local files via --out in cmd_brief. This is not remote compromise, but it is a real capability mismatch that could surprise a host agent or violate a least-privilege policy if file-write permission was not granted.
Although the skill markets itself as read-only with respect to the newsroom API, it can write local files via --out in cmd_brief. This is not remote compromise, but it is a real capability mismatch that could surprise a host agent or violate a least-privilege policy if file-write permission was not granted.
Although the skill markets itself as read-only with respect to the newsroom API, it can write local files via --out in cmd_brief. This is not remote compromise, but it is a real capability mismatch that could surprise a host agent or violate a least-privilege policy if file-write permission was not granted.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
The same _load_env() behavior applies to .env.local in the current working directory, which may be controlled by an untrusted project. This can make credential sourcing non-obvious and weaken the guarantee that secrets come only from a trusted user-controlled location.
def _load_env():
"""Read KEY=VALUE lines from .env / .env.local next to this script OR in the
current directory, without overriding anything already set in the environment.
Checking both means the key file is found whether you run from the script's
folder or from your project root. A current-directory file is restricted to
The same _load_env() behavior applies to .env.local in the current working directory, which may be controlled by an untrusted project. This can make credential sourcing non-obvious and weaken the guarantee that secrets come only from a trusted user-controlled location.
def _load_env():
"""Read KEY=VALUE lines from .env / .env.local next to this script OR in the
current directory, without overriding anything already set in the environment.
Checking both means the key file is found whether you run from the script's
folder or from your project root. A current-directory file is restricted to
The same issue applies to .env.local at this line: a workspace can influence secret loading simply by placing a file in the working directory. The code blocks destination override, which helps, but the skill still consumes repository-local credentials without clear opt-in.
script_dir = SCRIPT_DIR.resolve()
for d in (SCRIPT_DIR, Path.cwd()):
workspace = d.resolve() != script_dir
for name in (".env", ".env.local"):
p = (d / name).resolve()
if p in seen or not p.exists():
continue
The same issue applies to .env.local at this line: a workspace can influence secret loading simply by placing a file in the working directory. The code blocks destination override, which helps, but the skill still consumes repository-local credentials without clear opt-in.
script_dir = SCRIPT_DIR.resolve()
for d in (SCRIPT_DIR, Path.cwd()):
workspace = d.resolve() != script_dir
for name in (".env", ".env.local"):
p = (d / name).resolve()
if p in seen or not p.exists():
continue
The description says to 'Reach for it even when the request never says "API" or names the newsroom' and then lists phrases like 'has anyone reported on this' and 'find me what was written before.' These are common, broad research requests that could overlap with everyday conversation, making the activation boundary unclear for when this skill should or should not be invoked.
The file says it can target other newsrooms via NEWS_SITE and NEWS_COMMUNITY, but user-facing messages still direct users specifically to create a key at alaskanews.com/profile/settings. This natural-language guidance imposes an Alaska-specific organizational context on all users and is inconsistent with the documented multi-community behavior.
The 401 recovery text tells users that 'alaskanews API keys' are required and sends them to alaskanews.com/profile/settings, even though the client is described as reusable for other communities. This is a natural-language policy inconsistency that can misdirect users in non-Alaska deployments.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
back to the newsroom is a separate, editor-authenticated workflow, not this tool.
DEFAULTS to alaskanews.com, which is the only newsroom live on this platform
today. It is not limited to it: set NEWS_SITE and NEWS_COMMUNITY to point it at
another one. Nothing about a market is compiled in.
Terms of use are READ FROM THE NEWSROOM, per request, never assumed: robots.txt
The skill claims to be read-only and to never write back, but cmd_brief can write generated content to a local file with --out. While this does not write to the remote newsroom, it is still local state modification and can violate trust or sandbox expectations around a 'read-only' skill.
The argparse description states the tool is for 'the alaskanews.com public API', which conflicts with earlier documentation that it is configurable for other newsrooms. This fixed natural-language locale/service framing may violate organizational expectations for reusable multi-community skills.
No suspicious patterns detected.