Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed AI news briefing helper that searches and summarizes public web sources without persistence or destructive behavior.
Before installing, expect this skill to send AI-news search queries and article URLs to external search or web-reading services, and only use it in environments where outbound browsing and Tavily API key use are acceptable.
The description does not warn that the skill will perform web searches and retrieve content from third-party sites, including use of external search providers. Without clear disclosure, users may unknowingly trigger outbound requests, which is a transparency and privacy issue and can be risky in environments where browsing should be explicit.
The activation conditions are broad enough to match ordinary AI-related conversation, which can cause the skill to trigger and perform external searches or fetch third-party content when the user did not clearly request browsing. In an agent environment, overbroad triggers increase the chance of unintended tool use, unnecessary data sharing to external services, and confusion about why networked actions occurred.
The file includes Chinese trigger phrases as explicit invocation examples, but it does not clarify whether responses will follow the user's language or whether multilingual behavior is supported generally. This could create ambiguity around language handling and locale expectations.
The manifest describes a skill for aggregating and summarizing latest AI news from news websites and web search, with concise briefs and direct article links. At L280-L281, the documented follow-up behavior adds searching for Twitter reactions and analysis pieces, which is a different capability centered on opinion gathering rather than straightforward news briefing.
