Security audit

AI News Digest (中文版)

Security checks across malware telemetry and agentic risk

Overview

The skill’s news-digest behavior is coherent, but its install documentation promotes running mutable remote scripts directly, which users should review carefully before installing.

Prefer installing through ClawHub/openclaw or by manually copying an inspected SKILL.md. Avoid the curl | bash and irm | iex installer commands unless you first download, inspect, and verify the script. After installation, expect the skill to fetch public websites and create or update local digest files unless you specify a path or mode.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README instructs users to execute a remotely fetched shell/PowerShell installer directly via `curl|bash` and `irm|iex`, which gives the remote content immediate code execution on the user's machine with no review step. Even if the current script is benign, compromise of the repository, maintainer account, distribution path, or transient upstream content would turn installation into a one-step supply-chain compromise.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This installer flow again fetches a remote script and executes it immediately, but from a third-party package CDN (`unpkg.com`), increasing trust and supply-chain exposure. Users are asked to run downloaded code without any integrity verification, review step, or warning, so any upstream compromise or package substitution could execute arbitrary commands locally.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad enough to overlap with normal conversation about AI news, which can cause the skill to activate unexpectedly and perform web fetching plus filesystem writes. In this skill's context, accidental invocation is more concerning because it can create or archive files automatically and may launch many network requests across numerous sources.

Vague Triggers

Low

Confidence: 78% confidence
Finding: The examples say many phrasings should trigger the skill but do not define boundaries for ordinary discussion versus command intent. That ambiguity increases the chance of unintended execution, though the impact is limited to fetching content and writing digest files rather than executing arbitrary code.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill instructs the agent to create directories, archive prior files, and write markdown outputs on the user's system without a clear upfront warning that local files will be modified. In context this is somewhat mitigated because writing a digest is central to the skill's purpose, but silent filesystem changes still create risk of surprise writes, overwrites, or clutter in non-interactive environments.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The documentation indicates automatic writing to the user's Desktop and same-day reruns may update an existing file, yet the warning is only implicit and easy to miss. This can lead to unexpected local file creation or modification, which is a safety and consent issue even if the content is benign and the path is predictable.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.