Daily Ai News
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears benign: it fetches public AI news from a fixed external API, with only minor notes about network use and an undeclared curl dependency.
Before installing, confirm you are comfortable with the skill contacting https://60s.viki.moe for news and that curl is available on your system. The artifacts do not show credential access, persistence, or destructive actions.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill contacts the 60s.viki.moe service and returns remote content, but no local private data or credentials are sent by the script.
The skill uses a local shell script to make a network request to a fixed external news API. This is expected for the stated news-fetching purpose, and the script validates the user-controlled encoding and date parameters.
API_URL="https://60s.viki.moe/v2/ai-news" ... curl -s "$API_URL"
Use it for public AI-news requests, and treat returned news content as external information rather than trusted instructions.
The skill may fail on systems without curl, and users must rely on the included script rather than a fully declared runtime contract.
The metadata does not declare required binaries, while the included script depends on curl. This is an operational/provenance declaration gap, not evidence of malicious behavior.
Required binaries (all must exist): none; Required binaries (at least one): none; No install spec — this is an instruction-only skill.
Declare curl as a required binary, or confirm curl is available before using the skill.