ClawHub
Back to skill

Security audit

News Summarizer

Security checks across malware telemetry and agentic risk

Overview

This skill fetches public news RSS feeds and can optionally turn its summary into audio using OpenAI text-to-speech.

Use this for text news summaries freely. Only request voice summaries if you are comfortable sending the generated summary text to OpenAI and using an OpenAI API key; avoid including private or sensitive context in summaries that will be voiced.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The voice-summary flow sends generated summary text to an external OpenAI TTS endpoint without any explicit warning, consent step, or data-handling guidance. If the summary contains sensitive user-provided context or restricted content, this causes unintended third-party transmission and may violate user expectations or organizational data policies.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.