Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Kaspa news reader that fetches public kaspa.news data and formats it for users, with no evidence of credential use, persistence, or destructive behavior.
Install this if you are comfortable with the agent making public network requests to kaspa.news and presenting cached social/news content. Be aware that the trigger guidance is broad, so ambiguous mentions of kaspa.news could activate the skill; use explicit requests when you want it to fetch current Kaspa data.
The skill requires internet access to query a remote API but declares no explicit tool scope or allowed-tools/permissions boundary. In agent environments, undeclared network capability weakens policy enforcement and can let the skill be invoked with broader access than reviewers or operators expect.
The trigger phrase guidance is overly broad, especially the catch-all activation on 'Any mention of kaspa.news'. Broad triggers can cause the skill to activate in contexts where the user did not intend external fetching, increasing the chance of unnecessary network access, incorrect routing, or prompt-surface expansion from untrusted remote content.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
## 🔍 Per-User Tweet Search
When someone asks for tweets from a **specific person** (e.g., "show me @michaelsuttonil tweets from last 2 weeks"), this works for **ANY username** — not limited to the 9 built-in dev names.
### How to Query
No suspicious patterns detected.