newsnow-reader

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward command-line news reader that makes disclosed, purpose-aligned web requests to news platforms and does not show hidden persistence or credential theft.

Reasonable to install if you want a command-line hot-news reader. Review the outbound domains first, especially if running from a sensitive network, and note that the code contains an additional Jin10 source not fully documented in the visible source table.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation explicitly describes outbound HTTP requests to multiple third-party domains and local file handling, yet no permissions are declared. This creates a transparency and governance gap: users or hosting platforms may execute a skill with broader capabilities than its manifest communicates, increasing the risk of unexpected network egress in sensitive environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal