Security audit

AI新闻工具-免费版

Security checks across malware telemetry and agentic risk

Overview

This looks like a news-reading skill, but it asks for broad command execution and includes unrelated analytics and file-writing guidance that users should review before installing.

Install only if you are comfortable with an agent using shell commands and network requests to fetch news. Treat file-saving and caching examples as opt-in actions, and avoid using this skill for general analytics or report generation unless the publisher narrows those instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a read-only news retrieval tool, but its documented interfaces explicitly support create/query/export and modify/reset/import operations. This scope expansion is dangerous because it conditions an agent to perform state-changing actions that are unrelated to user expectations, increasing the chance of unauthorized local changes or misuse under a benign-looking skill name.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill claims to be a free personal news-reading tool, yet also advertises data analysis, report generation, statistical insights, and visualization workflows that exceed that scope. This mismatch can cause over-triggering and broaden the agent's behavior into unrelated processing tasks, making the skill a stealthy entry point for actions users did not intend when invoking a simple news tool.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill includes shell workflows that write news summaries to local files, which is not justified by a basic news retrieval purpose and is not clearly disclosed as a side effect. Any undocumented file-writing behavior is risky in an agent environment because it can alter the filesystem, overwrite user data, or be repurposed to persist unwanted content under the guise of normal tool usage.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions include generic keywords such as '新闻', '日报', and '头条', which are broad enough to match ordinary conversation and unrelated requests. Over-broad activation is dangerous because it can cause the skill to invoke exec/network-capable behavior unexpectedly, turning harmless user text into an unintended tool execution path.

Vague Triggers

High

Confidence: 96% confidence
Finding: The supplemental trigger says the skill should be used for data analysis, report generation, statistical insights, and visualization, which is both ambiguous and unrelated to a news reader. This broadens the set of prompts that can activate the skill and increases the likelihood that an agent uses a tool with exec capabilities in contexts far beyond what the user reasonably expects.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes writing a summary file to disk without a user-facing warning that local files will be created or modified. Hidden or under-disclosed persistence is dangerous in agent systems because users may believe they are only retrieving content, while the skill silently leaves artifacts on the filesystem that could consume space, expose data, or overwrite expected files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The caching example creates local JSON cache files but does not warn the user that data will be stored on disk. Even if the content is low sensitivity, undisclosed persistence changes the trust model of a read-oriented skill and can be abused to accumulate artifacts or retain information longer than the user intended.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.