newsnow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:34 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent news-fetching helper, but it authorizes and recommends running an unpinned npm package at runtime, which users should review before installing.

Review or pin the newsnow package before use, prefer a locally installed locked version over npx, and expose PRODUCTHUNT_API_TOKEN only for the specific Product Hunt command in a minimal environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npm Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–14 and line 143
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools:
  - Bash(newsnow *)
  - Bash(npx newsnow *)

markdown

Prefer `npx newsnow <source> --json` when the CLI is not installed globally.

Technical Analysis

The Skill authorizes and recommends executing npx newsnow without specifying an exact package version, lockfile, or integrity hash. If the package is not already installed, npx may retrieve the currently resolved newsnow package from the configured npm registry and execute it with the permissions of the Agent's operating-system user.

This creates a supply-chain trust boundary in which the code actually executed can change after the Skill has been reviewed. A compromised package release, registry account, package distribution channel, or unexpected future version could introduce arbitrary behavior without requiring any modification to SKILL.md.

The Skill also documents the optional PRODUCTHUNT_API_TOKEN environment variable. A package executed in the same process environment may be able to read this token and other environment variables or user-accessible files. The reviewed project does not contain the package implementation, a dependency manifest, or a lockfile, so its outbound destinations and credential handling cannot be independently verified from the project.

Network access itself is necessary for the declared news-fetching functionality. However, dynamically acquiring and executing an unpinned package is broader than the minimum access needed to retrieve news. No direct credential exfiltration or malicious package behavior was demonstrated in the reviewed file.

Attack Path

1. An attacker compromises the upstream npm package, its publisher account, or another relevant dependency in its supply chain.
2. The attacker p ...[truncated 1416 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin newsnow to an exact, reviewed version rather than allowing npm to resolve the latest available release:

   bash

   npx --yes newsnow@<exact-reviewed-version> <source> --json
   

2. Prefer a locally declared dependency with a committed package manifest and lockfile. Install dependencies during a controlled setup phase and execute the locked local binary afterward.

3. Verify package provenance, publisher identity, checksums, signatures, and registry source before approving a version.

4. Disable npm lifecycle scripts during installation where compatible with the package, and review any scripts that must remain enabled.

5. Expose PRODUCTHUNT_API_TOKEN only to the specific Product Hunt invocation that requires it. Do not place the token in a broadly inherited Agent environment.

6. Run the CLI in a sandbox with restricted filesystem access, a minimal environment, no unnecessary credentials, and outbound network access limited to documented news-service endpoints.

7. Document the expected outbound domains and validate that authentication tokens are transmitted only to their intended service.

8. Update the allowed command patterns and usage guidance so that unversioned npx newsnow execution is not authorized or recommended.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill manifest explicitly permits Bash(npx newsnow *), enabling execution of an unpinned npm package as a tool path. In a skill context, this is more dangerous than a casual doc example because it authorizes an agent to invoke code that may change over time without review, creating a direct supply-chain execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill allows execution via Bash(npx newsnow *), which fetches and runs the latest package version at runtime instead of a pinned, reviewed version. If the upstream package is compromised, typo-squatted, or a malicious update is published, users of the skill could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation recommends npx newsnow <source> --json when the CLI is not installed globally, which again causes runtime retrieval of an unpinned package version. This increases supply-chain risk because command execution depends on the current state of the npm registry rather than a fixed, vetted artifact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.