ClawHub
Back to skill

Security audit

hackernews-digest

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Hacker News digest helper, but users should run it only with a dedicated output folder because reruns can delete generated same-day files.

Install only if you want an agent to fetch public HN links and write a local daily digest. Set --base-dir or HN_DIGEST_BASE_DIR to a dedicated folder, and avoid pointing it at a directory containing unrelated work because reruns can overwrite or remove same-day generated output and temp files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad enough to activate on generic requests like '看看今天 HN 有什么' or '技术日报', which can cause the skill to run unexpectedly. Because the skill performs network fetches and file operations, accidental activation increases the chance of unintended external requests and local file modifications.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill instructs unconditional deletion of an existing output file and all temporary files in the working directory without any user warning or confirmation. If the base directory is misconfigured, user-controlled, or points at a sensitive location, this can destroy data unexpectedly and makes accidental activation materially more harmful.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.