Security audit

财联社自定义新闻日报

Security checks across malware telemetry and agentic risk

Overview

This skill mainly fetches public news, but it can automatically install a browser tool during ordinary use and has overly broad triggers that could start that behavior unexpectedly.

Install only if you are comfortable with this skill browsing 财联社 and with the agent-browser dependency. Prefer installing agent-browser manually through a trusted path first, use explicit 财联社-related prompts, and do not enable the cron block unless you want scheduled automatic runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill documentation instructs the agent to execute `runCommand("clawhub install agent-browser")` to install a tool, even though the manifest already declares `allowed-tools: browser`. Introducing shell-command execution expands privileges beyond the stated purpose of fetching and formatting news and creates a path for unintended command execution or supply-chain risk if the install source is compromised.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The workflow repeats the same command-execution pattern in an operational step, normalizing autonomous installation during runtime. This makes the skill more dangerous because a simple news lookup can trigger command execution and network-fetching behavior unrelated to the core task.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase "搜索[关键词]" is overly generic and can collide with ordinary user requests that are not intended to invoke this skill. This creates an invocation-confusion risk where the agent may unexpectedly launch browser automation and external web access in response to common language, increasing the chance of unintended actions or data exposure.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad enough to activate on common conversation such as generic requests to search for a keyword. In context, accidental activation is more dangerous because this skill can then browse external sites and, per the documentation, may attempt tool installation, causing unintended autonomous actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown describes automatic tool installation without a prominent warning or explicit consent gate before executing a command. This is dangerous because users may believe they are only requesting news retrieval, while the skill can instead perform system-modifying actions and network downloads behind the scenes.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The scheduled automation block enables recurring autonomous browsing and data retrieval but does not clearly warn that it will generate ongoing network activity without per-run user initiation. In this skill's context the impact is limited to repeated external access and possible surprise execution, but it still reduces transparency and control.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.