ClawHub
Back to skill

Security audit

Hot News Tool Free

Security checks across malware telemetry and agentic risk

Overview

This markdown-only news aggregation skill is broadly coherent, but users should notice that it may use command execution and outbound web access to fetch public news.

Install only if you are comfortable with an agent using network access and command execution for public news collection. Treat it as a user-directed news summary helper, not a general data-analysis tool, and review any generated command before running it because no actual implementation script is included in the artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger condition says to use this skill whenever 'data analysis, report generation, statistical insights, data visualization' are needed, which is far broader than the skill’s actual purpose of aggregating news. In an agent setting, this can cause the tool to be auto-selected for unrelated tasks and unnecessarily invoke networked scraping or shell execution, expanding attack surface and increasing the chance of unintended actions.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill describes external news aggregation and web scraping behavior but does not clearly warn users that it will access third-party websites over the network. In agent environments, missing disclosure can lead to unexpected outbound requests, privacy concerns, policy violations, or use in restricted environments where network access requires explicit consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.