ClawHub
Back to skill

Security audit

Daily News Brief Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward news-brief helper that fetches public news pages and writes local brief files, with no evidence of hidden or destructive behavior.

Before installing, expect the agent to run Python/shell examples, contact public news websites, install requests and beautifulsoup4 if needed, and save brief/cache files locally. Review or restrict the source URLs and output directory if you use it in a sensitive workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes executable examples that fetch remote content and write local files, but it does not provide an explicit warning or confirmation step before those side effects occur. In an agent setting with exec/read/glob/grep access, this can cause unanticipated network contact, data persistence, and environment modification from a natural-language prompt, increasing the risk of SSRF-like misuse, policy bypass, or accidental writes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.