File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:39
Security audit
Google News API
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed guide for using a paid Google News API service and does not contain hidden execution, persistence, or unrelated data access.
Before installing, be aware this skill uses a third-party paid service. Keep the Fetcher bearer key private, verify the x402 or prepaid billing model, and avoid sending sensitive private search terms or URLs unless you are comfortable sharing them with the provider.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal