Daily News
PassAudited by ClawScan on May 1, 2026.
Overview
This is a simple news-fetching skill that calls a disclosed public news API, with minor notes about network use and an undeclared curl dependency.
This skill appears safe for its stated purpose. Before installing, be aware that it will contact the 60s.viki.moe news API and that it needs curl available even though the metadata does not list it.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
When used, the agent contacts 60s.viki.moe and may send only the selected date and output encoding.
The skill runs a local shell script that makes a network request to a third-party API. This is disclosed and purpose-aligned for fetching news, and the user-controlled parameters are constrained.
API_URL="https://60s.viki.moe/v2/60s" ... curl -s "$API_URL"
Install only if you are comfortable with the agent contacting that news API; no private data or credentials are shown being sent.
The skill may fail if curl or a compatible shell is unavailable, even though the registry metadata does not warn about that requirement.
The metadata does not declare runtime requirements, while the included script invokes curl. This is a dependency declaration gap rather than evidence of hidden behavior.
Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
Ensure curl is available before use, and consider updating the skill metadata to declare its runtime dependency.