monitoring-google-news-coverage-for-brand

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:39 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Google News monitoring helper that sends brand/news queries to Apify and can save results locally, with no hidden or destructive behavior found.

Install this if you are comfortable sending the requested brand or company news queries to Apify and using an APIFY_TOKEN for that service. Avoid using sensitive investigation terms unless that sharing is acceptable, and choose output filenames carefully when saving reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description lists activation phrases like 'find recent news articles mentioning a company' and 'research how a company is being covered in the press,' which are broad enough to match ordinary user requests outside a narrowly defined Google News monitoring workflow. The trigger section also does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["\"[BRAND_NAME]\" news"], "maxPagesPerQuery": 3, "searchType": "news"}'

• Confidence: 94% confidence
• Finding: The skill explicitly sends user-supplied search queries to an external third-party service (Apify), which constitutes data exfiltration outside the local environment. In this skill's context that behavior is expected, but it is still security-relevant because brand names, monitoring targets, or investigation terms may be sensitive and the example also places the API token in the request URL, increasing credential exposure risk via logs or intermediaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["\"[BRAND_NAME]\" news"], "maxPagesPerQuery": 3, "searchType": "news"}'
```

• Confidence: 91% confidence
• Finding: The presence of the Apify API endpoint confirms outbound network transmission to a third party. While this is aligned with the skill's purpose, it remains a true vulnerability class because execution of the documented flow exports user-derived inputs and may expose operational metadata; in addition, embedding the token in the URL can leak credentials through shell history, proxy logs, or monitoring systems.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README recommends commands that automatically save results to CSV and JSON files, but it does not warn that running them writes files to disk and may overwrite paths chosen by the user. For markdown files, this qualifies as missing disclosure about behavior that can affect user data or system state.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.