Simple RSS news feed

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Using the skill will contact external news/RSS services and return their feed content.

Why it was flagged

The script makes outbound HTTP requests, but only to hardcoded RSS feed URLs defined in the FEEDS table, which is directly aligned with the news-fetching purpose.

Skill content

with urlopen(req, timeout=15) as resp:

Recommendation

Install only if you are comfortable with the agent fetching public news feeds over the network; treat returned headlines and summaries as external content, not instructions.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Requests for the AP feed may go to RSSHub rather than directly to AP, exposing normal request metadata such as IP address and user agent to that service.

Why it was flagged

The AP source is fetched through the third-party rsshub.app service, while the user-facing description simply lists AP as a source.

Skill content

"ap": {
        "top":      "https://rsshub.app/apnews/topics/apf-topnews",
    }

Recommendation

Consider disclosing RSSHub as the AP feed provider or replacing it with a direct AP RSS endpoint if available.