Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small Hacker News fetcher whose network access is disclosed and fits its stated purpose.
Before installing, expect the skill to run a local Python script that makes read-only requests to HN Algolia and prints public Hacker News story data. It does not appear to handle secrets or modify files, but users should be comfortable with that outbound network request and the Python requests dependency.
The skill instructs execution of a Python script that performs network access to an external API, but the manifest declares no explicit tool scope or permissions. This creates an authorization and governance gap: an agent may invoke network-capable code without clear least-privilege constraints, making review, enforcement, and user consent weaker.
The command help strings use Chinese text for argument descriptions, which imposes a specific language on users without any opt-in or alternative locale. This is a natural-language policy issue because the tool does not offer a language choice or document a justified locale restriction.
