Simple news feed reader (RSS)

• Analyzed: May 14, 2026, 3:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0e1212a2ee39437592f36a723d3b57aacb56f949ec9c9f0ee81d6b5f691ede75
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill The core Python script (`scripts/news.py`) and the skill instructions (`SKILL.md`) appear benign, focused on fetching and displaying news from RSS feeds using only standard libraries. However, the `.claude/settings.local.json` file grants unnecessary and broad Bash permissions, specifically `Bash(git add:*)`, `Bash(git commit:*)`, and `Bash(tree:*)`. These permissions are not required for a news-fetching skill and introduce a significant security risk, as they could be exploited by a prompt injection or a modified skill to perform unauthorized actions like modifying the repository or listing sensitive file structures.