Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed industry-news collection and notification helper; its network access, credentials, local history, and scheduled runs fit that purpose.
Before installing, configure only the destinations you intend to use, prefer least-privilege webhook or bot credentials, avoid committing secrets to files, and test with the documented dry-run mode before enabling cron delivery.
The skill explicitly describes collecting content from multiple external sources and pushing summaries to third-party channels, but it does not warn users that fetched content may be transmitted off-platform. This can cause unintended disclosure of collected material, metadata, or sensitive prompts/results, especially when users assume the skill only performs local aggregation.
The environment variable section requests webhook URLs, bot tokens, and SMTP credentials, but does not include handling guidance or warnings about secret exposure and external delivery. Users may paste production credentials without understanding that the skill will use them to send content externally, increasing the risk of credential misuse, unintended notifications, or data leakage through third-party messaging/email systems.
The description forces a specific language in the skill's natural-language interface and documentation. Under the policy, language-specific behavior should not be imposed without offering a user choice or clearly documenting a justified regional constraint.
No suspicious patterns detected.
