ClawHub
Back to skill

Security audit

AI Daily News

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent AI-news client, but users should know it contacts a remote service, can submit feedback or surveys, and stores local identifiers and preferences.

Install only if you are comfortable with an AI-news skill contacting its remote API, storing local preferences and engagement state, and sending feedback or survey text when you provide it. Keep AINEWS_ACCESS_TOKEN private, avoid untrusted AINEWS_SERVICE_URL overrides, and review any scheduled delivery plan before approving it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url = f"{base_url or DEFAULT_SERVICE_URL}/v1/manifest"
    try:
        req = urllib.request.Request(url, headers=_build_headers())
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        raise NetworkError(f"Manifest HTTP error: {e.code}")
Confidence
93% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(url, headers=headers)
        # urllib.request.urlopen defaults allow_redirects=True
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return resp.read()
    except urllib.error.HTTPError as e:
        if e.code == 404:
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = _build_headers(api_key)
    try:
        req = urllib.request.Request(url, headers=headers)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return resp.read()
    except urllib.error.HTTPError as e:
        if e.code == 401:
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        raise NetworkError(f"Execute HTTP error: {e.code}")
Confidence
92% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = _build_headers(api_key)
    try:
        req = urllib.request.Request(url, headers=headers)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        if e.code == 401:
Confidence
93% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = _build_headers(api_key)
    try:
        req = urllib.request.Request(url, headers=headers)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        if e.code == 401:
Confidence
93% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = _build_headers(api_key)
    try:
        req = urllib.request.Request(url, headers=headers)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        if e.code == 401:
Confidence
94% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Tainted flow: 'req' from os.getenv (line 303, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(url, data=data, headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return _read_json_response(resp)
    except urllib.error.HTTPError as e:
        try:
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as resp:

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill states that user feedback and survey answers will be 'automatically submitted' to a remote service, creating a data exfiltration path beyond core news retrieval. Because responses are natural-language and passed through largely unchanged, users may unknowingly send sensitive information or operational details to a third party.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The template directs the agent to create scheduled tasks, execute local scripts, invoke a local model/agent, and send output to arbitrary external channels. That materially expands the skill from AI-news retrieval into automation orchestration and outbound action, increasing the risk of unauthorized task creation, data exfiltration, misuse of local tooling, and persistence beyond the user’s immediate request. In the context of a news skill, these capabilities are broader than necessary and therefore more dangerous.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The file explicitly states a responsibility for 'Delivery log for ad impression tracking', which is outside the declared AI-news retrieval and analysis scope of the skill. This kind of undisclosed behavioral tracking creates a transparency and privacy issue: users and platform operators may invoke the skill expecting news functionality while the code also persists ad-related state locally.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The functions for recording deliveries and tracking whether ads were shown implement persistent ad-display state that does not align with the stated purpose of fetching and analyzing AI news. Even though the code is local and relatively simple, hidden tracking logic broadens the skill's behavior and can enable undisclosed user profiling, billing manipulation, or policy violations if consumed by other components.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This module persistently stores an install identifier and detailed engagement telemetry such as shown, submitted, and dismissed delivery IDs, plus upgrade and feedback cooldown state. For an AI news retrieval skill, that exceeds the stated purpose and creates unnecessary local tracking data that could be repurposed for profiling or later exfiltration, especially because the persistence is automatic and resilient to read/parse failures.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The file explicitly states responsibilities for anonymous install tracking and feedback/upgrade prompt management, which are unrelated to the advertised AI news aggregation and analysis purpose. This mismatch increases risk because users invoking a news skill would not reasonably expect durable behavioral tracking, making the capability more dangerous in this context than it would be in a clearly disclosed updater or product telemetry component.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill description focuses on AI news retrieval and analysis, but this code also submits engagement and survey telemetry to a remote endpoint. That mismatch is dangerous because users and integrators may not expect behavioral data collection, undermining informed consent and increasing privacy/compliance risk.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The client automatically adds install identifiers and capability fingerprints to requests even though that collection is not clearly necessary for an AI-news skill. Persistent identifiers and capability metadata can enable cross-session tracking and profiling if the remote service is compromised or over-collects data.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script transmits user feedback and survey responses to a remote service via submit_engagement(), even though the skill’s primary declared purpose is AI news retrieval and transformation. That creates an unnecessary outbound data flow for user-provided content, expanding data-collection scope and creating privacy/compliance risk if users are not clearly informed and the manifest does not justify this behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Automatic remote submission of feedback and survey responses is described without a prominent privacy warning or consent checkpoint. This increases the risk of collecting personal, confidential, or enterprise information under the guise of normal conversation flow.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill instructs the agent to persist user preferences locally without an upfront disclosure at the moment of collection. Even though the data stays local, silent storage of behavioral preferences can violate user expectations and create privacy risk on shared machines.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The agent-facing wrapper explicitly suggests copying, saving, writing to knowledge bases, and sending to external channels without embedding a confirmation or data-sharing safety check. In an agent ecosystem, this can normalize automatic exfiltration of generated or user-influenced content to third-party systems, especially if another component interprets these suggestions as authorization to act.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
A UUID-based install identifier is generated and later written to disk, creating a stable pseudonymous identifier without any indication in this file of notice, consent, or lifecycle management. Even if not directly sensitive by itself, a persistent identifier enables cross-session correlation of user behavior and becomes more risky when combined with the engagement event lists stored alongside it.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Timezone and client/install identifiers are transmitted in headers without any visible disclosure in this file. Even if individually low sensitivity, together they create trackable metadata that can reveal locale and device/session characteristics without user awareness.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The remote execution helper forwards arbitrary params to a server, but there is no visible warning that user-provided content may leave the local environment. In an agent skill, that can expose prompts, personal data, or sensitive workflow context to a third party unexpectedly.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
User feedback or survey content is submitted remotely without any visible privacy notice in this file. Feedback often contains free-form text that may include personal or confidential information, so silent transmission raises avoidable privacy and compliance concerns.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The generated guidance tells users to export a credential-bearing environment variable but does not include any warning about treating the token as sensitive, avoiding shell history leakage, or using secure secret storage. This is not direct credential theft, but it can normalize unsafe handling of access tokens and increase the chance of accidental exposure in terminals, logs, or shared shell profiles.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.