Security audit

News Sum

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its news-summary purpose, but it needs review because it can send generated news content through a configured Gmail command without clear pre-send safeguards.

Review before installing if you plan to use email delivery. The news-search and local archive behavior is expected, but before sending mail you should verify the recipient, subject, attachment, and generated body, and preferably require an explicit confirmation step or use a safer email tool that avoids raw shell interpolation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends user-requested content to an external email service without explicitly requiring a user-facing warning or confirmation that data will leave the local agent environment. This increases the risk of unintended data exfiltration, especially if summaries contain sensitive information or if the destination address is mistyped or attacker-controlled.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The prompt defines broad behavior for reading inputs, performing topic synthesis, doing extra searches, and writing output files, but it does not clearly constrain when the skill should activate or what requests should be refused. In an agent setting, ambiguous scope increases the chance of unintended invocation, over-collection of data, or execution of side effects beyond the user's precise intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to generate and write a draft file into the workspace without indicating that a filesystem modification will occur or requiring user confirmation. Silent file writes are dangerous because they create persistent side effects, can overwrite or clutter user data, and may be abused if the skill is triggered unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill mandates use of web_search to fetch additional content when local material is insufficient, but it does not disclose that external network access will occur or require consent. Undeclared outbound requests can leak user intent, create privacy/compliance issues, and expose the agent to untrusted remote content during execution.

Static analysis

No suspicious patterns detected.