RSS Feed Digest

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward RSS digest tool whose network and file access match its stated purpose.

Install only if you are comfortable adding the `feedparser` Python package and letting the skill contact the feed URLs you provide. Use reviewed feed-list files, choose output paths carefully because existing files may be overwritten, and treat generated digest text as untrusted external content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The examples instruct users to write output to files like digest.md and /tmp/daily-ai-digest.md without warning that files may be created or overwritten. This is low-severity because the writes are explicit and user-directed, but unclear documentation can still lead to accidental data loss or unsafe operational use, especially in automation contexts such as cron or heartbeat jobs.

VirusTotal

66/66 vendors flagged this skill as clean.