News Aggregator Skill

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 0.1.0
• Hash: 39fa5871d9d1fd1f9c197e282372484d4e9c2e184381f58dd1c8adb1d2f138c1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several risky capabilities, even though they are presented as part of the skill's stated purpose. The `SKILL.md` instructs the agent to perform 'deep fetching' using `python3 scripts/fetch_news.py --deep`, which involves downloading and extracting content from external, potentially untrusted, news sources. This introduces a significant attack surface for supply chain risks or vulnerabilities in content parsing. Additionally, the agent is instructed to read local files (`templates.md`) and write reports to the local filesystem (`reports/`), demonstrating file system interaction capabilities. While the prompt injection instruction for keyword expansion is for a functional purpose, the combination of network access to arbitrary external content and file system interactions, without the full script for review, elevates the risk profile beyond benign.