News Summary

Security checks across malware telemetry and agentic risk

Overview

This instruction-only news skill fetches public RSS headlines and optionally turns the resulting summary into audio using OpenAI TTS, with no evidence of hidden or destructive behavior.

This skill is reasonable to install for news briefings. Be aware that fetching current news contacts the listed public news sources, and using the voice feature sends the generated summary text to OpenAI and may incur API usage on your key. Avoid putting private notes into a voice summary unless you are comfortable transmitting them to OpenAI.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The voice-summary workflow sends generated summary text to an external TTS API without instructing the agent to warn the user or obtain consent. If the summary includes sensitive user-provided context, preferences, or proprietary information, this creates an unintended data disclosure to a third-party service.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal