Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple daily-news helper that calls a disclosed third-party news API and does not install persistence, request credentials, or run hidden code.
Install this only if you are comfortable sending news category and subcategory requests, along with normal network metadata such as IP address and timing, to the 6551 API. No credentials are required, and the inspected artifact does not show hidden code or persistence.
The skill instructs the agent to make unauthenticated requests to a third-party service without any user-facing disclosure or consent language. This can expose user metadata such as IP address, request timing, and query content to an external provider, which is a real privacy and trust issue even if the endpoint itself appears benign.
The response example highlights English-oriented fields such as summary_en and presents the skill entirely in English, while also exposing multilingual content fields. Because the file does not state whether users may choose their preferred language or locale, it may conflict with a policy requiring language choice rather than a fixed default.
No suspicious patterns detected.
