Security audit

ORF

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform its ORF news-and-image task, but it also reads a local OpenClaw API-key config and installs unpinned packages at runtime without clear disclosure.

Review before installing if you are not comfortable with the skill reading a Nano Banana/Gemini API key from your OpenClaw config and installing Python packages during use. Prefer setting GEMINI_API_KEY explicitly, inspect or pin the dependencies, and expect ORF headline data plus the generated image prompt to be sent to external services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill directs the agent to use network access, read local files/scripts, and invoke code, but the skill metadata does not declare those capabilities. Undeclared capabilities reduce transparency and policy enforcement, making it easier for a seemingly simple news skill to perform external fetches or local execution without clear review boundaries.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script creates a virtual environment and installs third-party Python packages at runtime, which expands the skill's capabilities beyond simple news retrieval into arbitrary code acquisition and execution from package indexes. In a skill advertised as a news digest/image generation helper, this increases supply-chain and unexpected network-execution risk, especially because the installation happens automatically without pinning versions or explicit user consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The procedure instructs the agent to run shell commands, pipe output between programs, and generate a file, all without any user-visible disclosure or consent. Even if the intended scripts are local and benign, command execution expands the attack surface because compromised scripts, unexpected arguments, or environment manipulation could lead to unintended actions.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The fallback tells the agent to use a browser tool to retrieve external content from ORF without informing the user that a network request will occur. This is primarily a transparency and privacy concern, since invoking browsing can expose request metadata and creates behavior the user may not expect from a simple command.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script silently installs packages and chains execution across Python and Node helpers, causing network access and execution of multiple components without any in-script warning or user acknowledgment. In this skill context, that makes behavior less transparent and increases the chance of surprising dependency downloads, supply-chain exposure, or hidden side effects inconsistent with a simple on-demand news digest.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script sends the full prompt to Google's external Gemini API without any in-script disclosure, prompt minimization, or safeguards against including sensitive data. In this skill context, user-provided news selections or generated prompts may include data that operators did not intend to transmit to a third party, creating a privacy and data-handling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.