Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward RSS news fetcher, with network access that fits its stated purpose.
Install this if you want an agent helper that fetches live headlines from external news RSS feeds. Be aware it will make outbound requests to the listed news/feed providers when used; no API keys, local data reads, persistence, or privileged actions were observed.
The skill invokes a Python script that performs outbound HTTP requests to multiple third-party RSS feeds, but the manifest does not declare any explicit tool scope or network permission boundary. This creates a transparency and governance gap: a caller or platform may not realize the skill reaches external services, making review, sandboxing, and policy enforcement harder.
The 'When to Use' section includes very general phrases such as 'latest news,' 'current events,' 'what's happening in the world,' and 'morning briefing.' These are common conversational requests and the file does not provide narrowing constraints or negative examples, so the skill could be invoked more broadly than intended.
The skill description says it uses HTTP and RSS feeds, but it does not clearly warn users that invoking the skill sends outbound requests to third-party news providers. This weakens informed consent and can surprise users in privacy-sensitive or restricted-network environments, especially when a simple query like 'latest news' causes external traffic.
No suspicious patterns detected.
