Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward public-news brief generator with disclosed web fetching and no evidence of credential access, persistence, destructive behavior, or hidden execution.
Before installing, understand that your industry or custom query may be sent to public search services and appear in fetched URLs. Avoid putting confidential company plans, private client names, or sensitive internal research topics into custom queries. The skill is otherwise narrowly scoped to producing sourced news briefs.
The skill invokes a shell-based helper script and requires curl, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where an agent may execute shell/network actions more broadly than a user would expect, increasing the risk of unintended command execution or uncontrolled outbound requests.
The structured output mandates Chinese/English bilingual headings such as '重点新闻 / Headlines' and '政策与监管 / Policy & Regulation'. This imposes a specific language/locale format without user opt-in or a documented justification for the locale constraint, which matches the language-policy violation criteria.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
mmonia`, `industrial heat`
## semiconductor
- SemiEngineering: https://semiengineering.com/
- AnandTech: https://www.anandtech.com/
- Reuters Tech: https://www.reuters.com/technology/
- Bloomberg Chips: https://www.bloomberg.com/semiconductors
Keywords: `fab`, `foundry`, `node`, `export control`, `CHIPS Act`, `equipment`, `EUV`, `wafer`
## biotech
- BioSpace: https://www.biospace.com/news/
- FiercePharma: https://www.fiercepharma.com/
- FDA: https://www.fda.gov/news-events
Keywords: `clinical trial`, `phase 3`, `FDA approval`, `EMA`, `biologic`, `gene therapy`, `CAR-T`
## General search tips
- Prefer sites with `lastModified` or explicit publish dates.
- Drop anything older than ~72 hours for a morning brief unless still unfolding.
- Deduplicate the same story across multiple outlets.
The skill performs external web requests to public search engines and publisher sites, but the user-facing description does not clearly warn about this behavior. That omission can mislead users about privacy and network activity, especially if their queries contain sensitive business interests or internal context that would be sent to third parties.
The script sets LANG="zh" by default, which imposes a specific language choice unless the user explicitly overrides it. This is a natural-language locale policy concern because the file includes bilingual output sections but defaults to Chinese without presenting it as an opt-in choice.
No suspicious patterns detected.