ClawHub
Back to skill

Security audit

newsflash

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent news briefing and alert integration, with disclosed network calls and alert persistence that fit its stated purpose.

Install this only if you want a hosted news service to receive your selected interests and categories for briefings or alerts. Review recurring briefing and alert settings before enabling them, and treat npx/newsflash.sh as external dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill description is extremely broad and is likely to trigger on many routine user requests about news, markets, crypto, or 'what's happening.' That can cause the agent to invoke this external-networked skill unnecessarily or preferentially, expanding the skill's influence over common conversations and increasing the chance of unintended data disclosure or over-reliance on third-party content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.