ClawHub
Back to skill

Security audit

每日新闻日报 v2.3

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed daily news report skill that searches public news sources, returns the full report, and keeps a local dated copy.

Install this if you want a Chinese-language daily public-news report workflow. Be aware it will perform multiple web searches and keep dated report copies under memory/; disable or delete that archive if local retention is not desired.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill requires saving the full generated report to a persistent memory file without notifying the user or obtaining consent. Persistent storage can expose sensitive user context, operational interests, or proprietary summaries to later sessions, other tools, or unintended readers, especially in shared or retained environments.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.