news-aggregator-skill
Warn
Audited by Snyk on Apr 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's fetch_news.py and SKILL.md explicitly fetch and scrape public, user-generated sources (e.g., Hacker News, GitHub Trending, Product Hunt, Weibo, V2EX, 36Kr, WallStreetCN) and with the --deep flag downloads and extracts full article text for analysis, meaning untrusted third-party content is ingested and used to drive summaries/decisions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata