ClawHub
Back to skill

Security audit

每日新闻日报 v2.0

Security checks across malware telemetry and agentic risk

Overview

This skill searches recent news, creates a Markdown daily report, and saves a local archive; the behavior is disclosed and fits the stated purpose.

Install if you are comfortable with the agent making current-news web searches and keeping dated Markdown news archives. Review any scheduled-run setup before enabling it, and delete old memory/daily_news_*.md files if you do not want retained reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly writes generated reports to `memory/daily_news_{YYYY-MM-DD}.md` without any user-facing notice about file creation, persistence, or retention. Silent persistence can expose user activity patterns, query history, or generated content to later readers of the workspace, and becomes riskier in shared or multi-tenant environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.