Security audit

👁️ Eyes · 大眼看世界（全球新闻·热点新闻·投资分析）- Global News Monitor

Security checks across malware telemetry and agentic risk

Overview

This is mostly a disclosed news-push automation skill, but it needs review because it can create scheduled outbound messages and includes under-disclosed fallback targeting and promotional message changes.

Install only if you want Eyes to send news summaries to your configured chat channels and potentially create recurring OpenClaw cron jobs. Before installing, confirm the destination channel, review or disable the BigA fallback/promo behavior, and make sure you know how to list and remove the cron jobs it creates.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to execute shell commands, create cron jobs, update itself, and write marker/state files, yet no permissions are declared. This creates a capability/consent gap where a user or platform may believe the skill is read-only analysis, while it can actually make persistent system and outbound messaging changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a hotspot monitoring tool, but the behavior includes local state maintenance, reading other tooling's config, installation state checks, and promotional/push behavior beyond pure analysis. Description-behavior mismatch is dangerous because it undermines informed consent and can hide persistence, cross-tool data use, or unsolicited outbound actions behind a benign description.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Self-update plus cron reconfiguration gives the skill the ability to change its own future behavior and alter persistent execution settings. Even if intended for maintenance, this expands the attack surface and can be abused to introduce unreviewed changes or modify scheduled behavior without clear user scrutiny.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Installing persistent cron jobs and writing installation markers goes beyond one-time analysis and creates durable behavior on the host and external channels. Persistence is risky because accidental or malicious activation can continue generating outbound traffic and system changes long after the initial interaction.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This utility is framed as a hotspot analysis helper, but it contains active outbound messaging logic that can deliver content to Feishu via local configuration or caller-supplied targets. That expands the skill from analysis into exfiltration/notification behavior, increasing the chance of unintended disclosure or misuse, especially in an automated Cron-triggered context.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The docstring advertises only maintenance and formatting commands while omitting the implemented send-segments command, which performs external message delivery. Understating side-effectful behavior is dangerous because reviewers and operators may treat the script as local-only and unknowingly permit outbound transmission.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger list contains broad everyday phrases, increasing the chance of accidental activation during normal conversation. Because activation leads to searches, shell commands, and outbound pushes, an unintended match can cause external side effects without meaningful user intent.

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill says any trigger causes immediate execution without further confirmation or constraints. In a skill that performs outbound messaging and persistent operations, immediate execution materially raises the risk of accidental data transmission, spam, or unauthorized system changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill directs automatic outbound message sending across channels but does not clearly warn the user at the point of action that content will be transmitted externally. This weakens user awareness and can lead to unintentional disclosure or spam via whatever delivery target is configured.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions create cron jobs and write marker files without a clear user-facing warning about persistence and host modification. Persistent changes should never be implicit in a content-analysis skill because users may not realize the action survives the current session.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code silently loads channel/target values from a local shared configuration file and then uses them for outbound delivery if the caller omits parameters. This can cause data to be sent to an external recipient without an explicit user-facing warning or confirmation, which is especially risky for scheduled automation.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill reads user-specific timezone/configuration data and uses channel targeting data for outbound pushes without clear minimization boundaries or consent language. Combining user metadata with automatic delivery increases privacy risk and can route content to unintended destinations if config is stale or shared.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The workflow instructs the agent to check whether any prior send occurred and, if not, to send the full generated content as a fallback. This replay-oriented logic can cause duplicate or unintended delivery of potentially sensitive content and prioritizes transmission over user confirmation.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The function automatically prepends and appends marketing/install prompts to outbound messages before sending them to external recipients. This mutates user-provided content and can disclose operational details or create unintended communications, especially when the original content is expected to be sent verbatim to a recipient.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The trigger '大眼' is extremely short and likely to appear in ordinary conversation, making accidental activation plausible. Given that activation can launch searches and outbound push workflows, even a low-complexity trigger can have outsized side effects.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.