Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed crypto-news automation skill with no bundled executable code or hidden behavior, though users should treat scheduling and future account-connected extensions carefully.
Before installing, verify the actual implementation if one is later provided, use scoped API keys, keep scheduled runs opt-in, and require manual approval before enabling any future social posting, messaging, or trading features.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│
├── index.js # Entry point
├── agent.config.json
├── .env
├── package.json
├── skill.md
└── README.md
The README promotes automated scheduling and explicitly proposes future integrations for social posting, broadcast bots, and auto-trading without strong safety guidance, approval gates, or warnings about autonomous actions against external systems. In an agent context, this can normalize deployment of unattended actions that may post content, send messages, or eventually place trades, increasing the risk of account misuse, financial loss, or unintended automation.
The skill explicitly describes automatic external news fetching and later scheduled autonomous execution, but it does not disclose network access, data egress, source trust boundaries, or require user acknowledgment. This creates a real security and transparency issue because users may enable a skill that performs unattended outbound requests and consumes untrusted remote content, which can lead to privacy, compliance, cost, or downstream prompt/content-manipulation risks.