Skills/ClawHub/follow-news

follow-news@3.18.0

CAUTION· static only

Publisher claims: "Generate tech news digests with unified source model, internal ranking, and multi-format output. Seven-source data collection from RSS feeds, Twitter/X KOLs,..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher tangwz · publishing for 175 daysInstalls 1,027Last detonated 3 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 49/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Python subprocess execution detectedscripts/fetch-twitter.py:805 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch-twitter.py:574 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch-github.py:189 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationscripts/fetch-twitter.py:61 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeOPENCLI_AUTO_UPDATE_DEFAULT = TrueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionSKILL.md:57 · File type combined with upload action — agent may exfiltrate local data files| Write | `/tmp/td-*.json` | Temporary pipeline intermediate outputs. |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fetch-reddit.py:5 · File type combined with upload action — agent may exfiltrate local data filesReads sources.json, filters Reddit sources, fetches posts via Reddit JSON API,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/fetch-podcast.py:827 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionSKILL.md:7 · File type combined with upload action — agent may exfiltrate local data files…description":"Previous digests for deduplication."}],"write":[{"path":"/tmp/td-*.json","description":"Temporary pipeline intermediate outputs."},{"path":"/tmp/td-email.html","description":"Temporary email HTML body."},{"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/fetch-podcast.py:383 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationscripts/fetch-twitter.py:2674 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeopencli_auto_update=(not args.no_update) and _opencli_auto_update_enabled(),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/enrich-articles.py:11 · File type combined with upload action — agent may exfiltrate local data filespython3 enrich-articles.py --input merged.json --output enriched.json [--min-score 10] [--verbose]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationscripts/fetch-twitter.py:603 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif not _opencli_auto_update_enabled():Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/run-pipeline.py:131 · File type combined with upload action — agent may exfiltrate local data filesparser.add_argument("--output", "-o", type=Path, default=Path("/tmp/td-merged.json"), help="Final merged output")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/fetch-twitter.py:788 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/doctor.py:53 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/run-pipeline.py:64 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsSKILL.md:650 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…. ### Credential & File Access Scripts do **not** directly read `~/.config/`, `~/.ssh/`, or any credential files. API tokens used directly by the scripts are read fr…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch-podcast.py:866 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationscripts/fetch-twitter.py:16 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeOPENCLI_AUTO_UPDATE - Enable OpenCLI automatic update check (default: 1/true)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fetch-twitter.py:1625 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch-podcast.py:472 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationscripts/fetch-twitter.py:465 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef _opencli_auto_update_enabled() -> bool:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/fetch-twitter.py:5 · File type combined with upload action — agent may exfiltrate local data filesReads sources.json, filters Twitter sources, fetches recent posts usingFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Reads credential paths from the home directorySKILL.md:650 · Reads credential paths from the home directory…ed from fetched data. ### Credential & File Access Scripts do **not** directly read `~/.config/`, `~/.ssh/`, or any credential files. API tokens used directly by the scripts are read fr…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedscripts/fetch-twitter.py:386 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/run-pipeline.py:140 · File type combined with upload action — agent may exfiltrate local data filesparser.add_argument("--debug", action="store_true", help="Keep intermediate fetch outputs (rss.json, twitter.json, etc.) alongside final output")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/merge-sources.py:613 · File type combined with upload action — agent may exfiltrate local data filespython3 merge-sources.py --rss rss.json --output merged.json --verboseFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:300 · File type combined with upload action — agent may exfiltrate local data filespython3 scripts/enrich-articles.py --input merged.json --output enriched.json [--min-score 10] [--max-articles 15] [--verbose]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/test_acceptance_digest.py:4552 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
URL to a private-network addresstests/test_config_editor_server.py:907 · URL to a private-network address — a LAN or development target"Origin": f"http://192.168.1.12:{port}",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionscripts/source-health.py:8 · File type combined with upload action — agent may exfiltrate local data filespython3 source-health.py --rss rss.json --twitter twitter.json --github github.json [--output health.json]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/test_config.py:521 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_fetch_twitter_opencli.py:47 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif _OPENCLI_AUTO_UPDATE_PARAM_INDEX is None:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_config.py:485 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/send-email.py:79 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_fetch_twitter_opencli.py:51 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"fetch_with_backend_chain was called without expected opencli_auto_update positional arg"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
URL to a private-network addresstests/test_config_editor_server.py:972 · URL to a private-network address — a LAN or development target"Origin": f"http://192.168.1.12:{port}",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/send-email.py:57 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_fetch_twitter_opencli.py:743 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_auto_update_runs_before_min_version_gate(Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_fetch_twitter_opencli.py:791 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_auto_update_forces_retry_when_throttled_and_version_too_old(Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Financial transfer languagetests/fixtures/twitter.json:26 · Financial transfer language — potential advance-fee scam · informational: not an instruction file…h Korea’s tax authority mistakenly published the recovery mnemonic for a seized crypto wallet in a press release photo, and soon after about $4.8 million worth of tokens were…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Auto-update or dynamic fetch configurationtests/test_fetch_twitter_opencli.py:771 · Auto-update or dynamic fetch configuration — agent may load new code at runtimebackend = fetch_twitter.OpenCliBackend(auto_update=True, no_cache=True)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_acceptance_digest.py:4583 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈9,037 tok
1 file · 76 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

31 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim tangwz: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Reads credential paths from the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tangwzPropose a patch to the maintainer