ClawHub
Back to skill

Security audit

每日新闻日报 v2.0

Security checks across malware telemetry and agentic risk

Overview

This skill searches recent public news and saves a daily Markdown report, with no hidden code or unsafe data access found.

Install if you want manual or scheduled daily news reports. Review the weekday cron behavior, and periodically delete memory/daily_news_*.md if you do not want old reports retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to save generated reports to `memory/daily_news_{YYYY-MM-DD}.md` without any user notice, consent, retention policy, or sensitivity check. Silent persistence can create privacy and governance risks, especially if reports include user-request context, are retained indefinitely, or are accessible to other skills or later sessions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.