Ai News Zh.Bak

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.0

Overview

This skill is an instruction-only AI news briefing workflow that clearly discloses web fetching and optional posting to chat channels.

Install this only if you want an agent to fetch public AI news and, if configured, post daily briefings to your chosen chat channel. Run it manually once first, use a limited test destination before enabling scheduled posting, and keep any optional search API key scoped to search only.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly advertises automatic pushing of compiled news to external channels such as Feishu, Telegram, and Discord, but it does not clearly warn that content will be transmitted off-platform. In an agent setting, undisclosed outbound delivery can cause users to unintentionally publish summaries, source excerpts, or operational metadata to third-party services, especially when scheduled automation is enabled.

VirusTotal

65/65 vendors flagged this skill as clean.