newsflash

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.1

Overview

This news skill is purpose-aligned, but it asks agents to run an unpinned npm CLI and maintain recurring/background activity in ways that need review before installation.

Install only if you are comfortable with an agent running the `newsflash` npm CLI in your workspace. Prefer a version-pinned or direct HTTPS implementation, require explicit approval before creating `newsflash.json`, starting streams, or scheduling cron jobs, and avoid exposing unrelated secrets to the CLI process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:65

Finding

Mandatory Branded Content Injected into Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–83
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Complete Code Snippet

text

4. **Compose** in this shape (match the user's channel formatting):

🌅 Morning News Briefing <Weekday, Month D, YYYY> • <time> <tz> ━━━━━━━━━━━━━━━━━━━━━━

💻 Technology

1. <Headline> — <one clause on why it matters>. ✔ 5 outlets (engadget, techcrunch, theverge, …) <link>
2. …

🪙 Crypto …

👀 Watchlist (single-source, unconfirmed) • <headline> — only <outlet> so far. <link>

━━━━━━━━━━━━━━━━━━━━━━ Deduped & corroboration-ranked by newsflash.sh — ✔ N outlets = independently confirmed

text

Technical Analysis

The briefing instructions prescribe a fixed, service-branded footer in every generated briefing. This changes the content of the agent's user-facing response by requiring promotional attribution that the user did not necessarily request.

The affected instruction does not directly override system safety controls or enable code execution. Its security significance is limited to control of response content and undisclosed promotional influence. The issue is therefore classified as instruction hijacking with a low risk level.

Attack Path

1. The agent loads the Skill instructions.
2. A user requests a news briefing.
3. The agent follows the mandatory composition template.
4. The generated response includes the fixed newsflash.sh branding regardless of whether the user requested that promotional footer.

Impact Assessment

The instruction can influence the content and neutrality of responses produced while this Skill is active. It does not grant filesystem, operating-system, credential, or network privileges. Its scope is limited to user-facing briefing output, but it may cause users to interpret promotional text as a neutral or agent-select ...[truncated 15 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory branded footer from the briefing template.
• If provenance is needed, use neutral wording such as “Source data provided by newsflash.sh.”
• Include service attribution only when required for licensing, requested by the user, or necessary to explain data provenance.
• Clearly distinguish factual provenance from advertising or endorsement.
• Allow the user or calling application to control whether attribution is displayed.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52

Finding

Unpinned Third-Party npm Package Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–57, 95–98, 117, and 126–127
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippets

text

1. **Gather.** Per configured category:
   `npx newsflash events --json -c <category> -n 60`
   — keep the events with `corroboration >= 2`, sorted by corroboration, top
   4–5 per category. Per interest additionally:
   `npx newsflash events --semantic -q "<interest>" --json -n 6`.

text

If `alerts.enabled`, keep a background process running:

npx newsflash stream --json --min-sources <min_sources>

text

text

- "what's happening with X" → `npx newsflash events --semantic -q "X" --json -n 8`

text

key: `npx newsflash login` (email + one-time code, ~30s). Premium
(`npx newsflash upgrade`, $29/mo): full 5-year archive, 50k req/day, 10

Technical Analysis

The Skill repeatedly instructs the agent to execute npx newsflash without specifying an exact package version, integrity hash, trusted package source, or reviewed local installation. Depending on the local npm and npx configuration, this can cause the current package version to be downloaded from the configured npm registry and executed at runtime.

An unpinned package is mutable after the Skill has been audited. If the package account, registry, release process, or dependency chain is compromised, a later package release could execute attacker-controlled JavaScript. npm package execution may also involve lifecycle scripts and transitive dependencies. The streaming instruction increases exposure by directing the agent to keep the package running and restart it if it exits.

No evidence in the audited file establishes that the newsflash package is currently malicious. The vulnerability is the unsafe trust and execution model: the reviewed Skill delegates local execution to mutable, externally supplied ...[truncated 1586 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer the documented HTTPS API directly rather than executing an npm package when equivalent functionality is available.
• If the CLI is required, pin it to an explicitly reviewed version, for example npx --yes newsflash@<reviewed-version>, and update only through a controlled review process.
• Install dependencies from a lockfile that records exact versions and integrity hashes instead of resolving the latest package during each invocation.
• Verify package ownership, provenance, signatures, source repository, and release artifacts before approval.
• Use a trusted registry and prevent dependency resolution from untrusted or user-controlled registry configurations.
• Disable npm lifecycle scripts where compatible with the package and deployment model.
• Run the CLI in a sandbox with a minimal environment, restricted filesystem access, limited outbound network access, and no unrelated credentials.
• Do not expose NEWSFLASH_API_KEY or other secrets to the process unless required; use a narrowly scoped credential where supported.
• Apply process supervision limits to the stream, including explicit termination, resource limits, logging, and a bounded restart policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says to use the skill when the user asks about "news, headlines, markets, crypto, what's happening" or wants alerts. Phrases like "what's happening" and broad topics like "markets" or "crypto" are common in everyday conversation and do not clearly bound when this skill should activate versus when a more general response would be appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to create and maintain newsflash.json in the workspace without an explicit user-facing warning or consent gate for local file modification. Silent persistence can surprise users, overwrite existing preferences, or create a foothold for ongoing behavior changes based on stored state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx newsflash without pinning an exact package version, which means future executions may fetch and run whatever code is currently published under that package name. In an agent context, this creates a supply-chain execution risk: a compromised maintainer account, malicious update, or dependency hijack could turn routine news queries into arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This command again relies on unpinned npx newsflash, causing dynamic retrieval and execution of remote package code at runtime. Because the skill is meant for repeated operational use, the exposure is ongoing and could be exploited long after deployment via a malicious package update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs the agent to keep a background process running continuously and to restart it if it dies, but does not require a clear user warning about persistent network activity. This creates meaningful security and privacy risk because a long-lived process can continuously send/receive data, maintain state, and outlast the user's immediate expectation of a one-time news request.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using unpinned npx newsflash for a persistent stream is especially risky because it launches long-running third-party code fetched at execution time. A malicious package version could maintain persistence, exfiltrate workspace data, or abuse the continuous process model for stealthier impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This ad-hoc query instruction executes an unpinned npx package, exposing the environment to arbitrary code from the npm supply chain. Even though the functional goal is simple search, the mechanism grants code execution capabilities far beyond what is needed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The login instruction invokes unpinned npx newsflash, which still carries package substitution or malicious update risk despite being framed as an account setup step. The context is less directly exploitable than unattended background usage, but it still executes remote package code on demand.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The upgrade command uses unpinned npx newsflash, so a billing-related action is coupled with execution of mutable third-party code. While likely intended for convenience, this increases risk around sensitive flows and could enable credential theft or social engineering if the package is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.