marsbit-news-skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.7

Overview

This skill is a straightforward MarsBit news lookup integration that uses curl to contact a disclosed hosted endpoint.

Install only if you are comfortable sending MarsBit search terms and news IDs to www.marsbit.co. Prefer the ClawHub install path, and if using the GitHub fallback, review the repository before copying files into your OpenClaw skills directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Scope Creep

Medium

• Confidence: 94% confidence
• Finding: The skill declares the "exec" tool even though its stated purpose is only to fetch hosted news and flash data. Granting command execution expands the attack surface significantly because any future skill logic or prompt-influenced behavior could invoke shell commands, making a read-only data skill capable of arbitrary local actions.

VirusTotal

64/64 vendors flagged this skill as clean.