newsnow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 PM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it can run an unpinned npm CLI through npx, which makes the executed code mutable after review.

Review this before installing. It appears purpose-aligned, but prefer a pinned, preinstalled, reviewed newsnow binary and expose PRODUCTHUNT_API_TOKEN only when using the Product Hunt source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npm Package Can Execute Mutable Third-Party Code at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15
Vulnerability Type: Unpinned runtime dependency and supply-chain execution risk
Risk Level: Medium

Vulnerable Code Snippet:

yaml

Requires npm install. Some sources need env vars (PRODUCTHUNT_API_TOKEN).
allowed-tools:
  - Bash(newsnow *)
  - Bash(npx newsnow *)

Technical Analysis

The Skill permits execution of npx newsnow * without specifying an exact package version, integrity hash, lockfile, or reviewed local installation. If the package is not already installed, npx may retrieve the current newsnow package from the configured npm registry and execute it.

This makes the effective code mutable after the Skill has been reviewed. A compromised npm package, publishing account, registry configuration, or future malicious release could introduce arbitrary behavior without requiring a change to SKILL.md. The repository contains no bundled implementation with which to verify the CLI's actual network requests or handling of PRODUCTHUNT_API_TOKEN.

Fetching news over the network is necessary for the declared functionality. However, dynamically acquiring executable package code is not the minimum privilege necessary; the Skill could instead invoke a pinned and integrity-verified local binary.

Attack Path

1. An attacker compromises the newsnow npm package, its publisher credentials, or the package-resolution path used by the environment.
2. The attacker publishes a malicious version under the package name resolved by npx newsnow.
3. An Agent invokes an allowed command such as npx newsnow hackernews --json.
4. If no verified local package satisfies the request, npx downloads the attacker-controlled package.
5. Package lifecycle logic or the CLI entry point executes with the operating-system privileges granted to the Agent process.
6. The malicious code can attempt to read accessible files and environment variables ...[truncated 1054 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove runtime package retrieval through unrestricted npx newsnow.
2. Pin newsnow to a specifically reviewed version rather than resolving the latest available release.
3. Install the dependency during a controlled build or deployment stage using a lockfile and npm integrity metadata.
4. Invoke only the verified local binary, preferably with npm configured to prohibit installation during Skill execution.
5. Verify the package publisher, registry origin, release provenance, and package checksums before deployment.
6. Disable or carefully review npm lifecycle scripts during installation where operationally possible.
7. Run the CLI in a restricted sandbox with minimal filesystem access, a limited environment, and outbound network access restricted to documented news and API endpoints.
8. Expose PRODUCTHUNT_API_TOKEN only for Product Hunt requests, rather than inheriting it for every source invocation.
9. Document the exact Product Hunt API endpoint that receives the token and ensure it is transmitted only over authenticated TLS.
10. Periodically re-audit package updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The manifest references npx newsnow without an exact version pin, creating a supply-chain risk. Because this skill is specifically designed to run a CLI fetched from npm, the unpinned reference increases the chance that future package changes or a malicious publish result in arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill allows execution via npx newsnow * without pinning an exact package version. npx may fetch the latest published package at runtime, so a compromised maintainer account, malicious new release, or dependency hijack could cause arbitrary code execution when the skill is invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.