Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only local-news research client; it uses a newsroom API key and network access but does not show hidden writes, persistence, or deceptive behavior.
Install only if you want a local-news research helper that can contact Communities News newsroom APIs. Use a read-only cn_ key where possible, keep .env files trusted, and be aware that article URLs supplied to the tool are fetched from the network.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never NEWS_SITE or PLATFORM_API_BASE):
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hold the key but never `NEWS_SITE` or `PLATFORM_API_BASE`):
```bash
echo 'COMMUNITIES_NEWS_API_KEY=cn_...' >> scripts/.env.local
```
Access is tiered on the platform side, and your key may not reach everything.
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
super().__init__(f"HTTP {code}: {body[:300]}")
# What a .env in the CURRENT DIRECTORY may set. That directory is whatever project
# the skill happens to run in, so its .env is workspace-controlled: if it could set
# NEWS_SITE or PLATFORM_API_BASE it could choose where your key is sent, and an agent
# working inside an untrusted repository would carry your exported key there. It may
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
script_dir = SCRIPT_DIR.resolve()
for d in (SCRIPT_DIR, Path.cwd()):
workspace = d.resolve() != script_dir
for name in (".env", ".env.local"):
p = (d / name).resolve()
if p in seen or not p.exists():
continue
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
script_dir = SCRIPT_DIR.resolve()
for d in (SCRIPT_DIR, Path.cwd()):
workspace = d.resolve() != script_dir
for name in (".env", ".env.local"):
p = (d / name).resolve()
if p in seen or not p.exists():
continue
The description says to use the skill even when the request never says "API" or names the newsroom, then lists broad phrases like "has anyone reported on this" and "when does the assembly next meet." These phrases are common user requests and the file does not provide exclusion conditions or boundaries, which could cause unintended invocation in ordinary conversation.
The article command accepts any full URL beginning with http and fetches it with fetch_markdown(), without restricting host/origin to the configured newsroom or an allowlist. This expands the tool from a newsroom API client into a general outbound fetcher, creating SSRF-like behavior, policy bypass, and the possibility of retrieving attacker-controlled content under the guise of this skill.
The parser help for person promises 'every article quoting them (with the quote)'. But cmd_person explicitly documents and renders a union of quoted matches and structurally linked articles without quotes, warning that rows without verbatim_excerpt are not quotable.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
back to the newsroom is a separate, editor-authenticated workflow, not this tool.
DEFAULTS to alaskanews.com, which is the only newsroom live on this platform
today. It is not limited to it: set NEWS_SITE and NEWS_COMMUNITY to point it at
another one. Nothing about a market is compiled in.
Terms of use are READ FROM THE NEWSROOM, per request, never assumed: robots.txt