v0.1.0

Daily News

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:05 AM.

Analysis

This is a simple news-fetching skill that calls a disclosed public news API, with minor notes about network use and an undeclared curl dependency.

GuidanceThis skill appears safe for its stated purpose. Before installing, be aware that it will contact the 60s.viki.moe news API and that it needs curl available even though the metadata does not list it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

scripts/news.sh

API_URL="https://60s.viki.moe/v2/60s"
...
curl -s "$API_URL"

The skill runs a local shell script that makes a network request to a third-party API. This is disclosed and purpose-aligned for fetching news, and the user-controlled parameters are constrained.

User impactWhen used, the agent contacts 60s.viki.moe and may send only the selected date and output encoding.

RecommendationInstall only if you are comfortable with the agent contacting that news API; no private data or credentials are shown being sent.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Required binaries (all must exist): none
...
No install spec — this is an instruction-only skill.

The metadata does not declare runtime requirements, while the included script invokes curl. This is a dependency declaration gap rather than evidence of hidden behavior.

User impactThe skill may fail if curl or a compatible shell is unavailable, even though the registry metadata does not warn about that requirement.

RecommendationEnsure curl is available before use, and consider updating the skill metadata to declare its runtime dependency.