Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cnn
v1.0.2Provides 24/7 news coverage from CNN's flagship channel, international editions, and key programs like Anderson Cooper 360°.
⭐ 0· 50·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill metadata/description claims it 'provides 24/7 news coverage' from CNN, which implies live feeds, external APIs, or streaming capability; however the skill has no install steps, no required binaries, no environment variables, and no code—only an instruction doc that describes producing background information about CNN. The requested surface (none) is not sufficient for delivering live coverage, so the declared purpose and actual capability are inconsistent.
Instruction Scope
SKILL.md is concise and scoped to producing background/contextual information (founding history, core offerings, global footprint, recent major news). It does not instruct the agent to read local files, access system environment, or contact external endpoints, which limits its scope and reduces risk. However, it is vague about sources for 'recent major news' (no guidance to use authoritative APIs or cite sources), so its behavior could vary depending on the agent's access to external information.
Install Mechanism
No install spec and no code files (instruction-only). This is low-risk from an installation standpoint because nothing is written to disk and no external packages are fetched.
Credentials
The skill requests no credentials or environment variables, which would be appropriate for an instruction-only background briefing. However, the advertised capability (live CNN coverage) would normally require credentials or integration details—those are missing, which is a proportionality/incoherence concern: either the description is overstated or the skill is incomplete.
Persistence & Privilege
always is false and there is no indication the skill writes persistent configuration or requests elevated privileges. It does not ask to modify other skills or system-wide settings.
What to consider before installing
What to consider before installing:
- This skill likely only provides static/background summaries about CNN (per SKILL.md). It does not actually connect to CNN or deliver live 24/7 coverage despite the description. If you need real-time news or licensed feeds, this skill is not sufficient.
- Because it is instruction-only with no install or requested credentials, it poses low technical risk, but its description is misleading. Ask the publisher (or check a homepage/source) whether the skill will access live feeds, and request details (APIs, endpoints, required credentials) if you expect real-time coverage.
- If you install it, treat outputs as general background/context and verify any 'recent news' claims against authoritative sources. If you require a skill that integrates with CNN or other news providers, prefer one that documents its data sources and required credentials/accounts.Like a lobster shell, security has layers — review code before you run it.
latestvk97dt2xrafxp1920q1j7mnanzx84xxwa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.