ClawHub

ZAKER category news 行业热门新闻

Security checks across malware telemetry and agentic risk

Overview

This skill fetches category-based news from a documented public API and does not request credentials, persistence, or local data access.

Install only if you are comfortable with the agent contacting skills.myzaker.com for news queries and presenting links returned by that service. The publisher should ideally narrow broad trigger examples and clarify language preference handling, but no malicious or suspicious behavior was found in the artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill explicitly says it should activate on '弱分类表达 / Soft category intent' even when the user does not mention news, using examples like 'How’s AI lately?' and 'Anything in entertainment?'. These phrases are common conversational requests that could seek analysis, opinions, or general discussion rather than news, so the activation boundary is too broad.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The document consistently presents the skill in both Chinese and English and includes mixed-language trigger guidance, but it does not state that language should follow the user's preference. This can violate language/locale policy if the skill responds in a fixed or mixed language without opt-in.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal