daily-ai-news
Verdict safe, but 1 finding (1 medium), mainly prompt injection. Most recent scan 2026-02-05.
This skill presents a MEDIUM security risk primarily due to transitive trust abuse. The skill fetches and processes content from arbitrary external websites without proper validation, creating a vulnerability where malicious web content could inject instructions. The skill also has minor issues with missing optional metadata and incomplete file references. However, there are no critical threats like data exfiltration, hardcoded credentials, or command injection. The skill's core functionality (aggregating AI news) is legitimate, but the implementation needs security hardening around external content handling.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Aggregates and summarizes the latest AI news from multiple sources including AI news websites and web search. Provides concise news briefs with direct links to original articles. Activates when user asks for 'today's AI news', 'AI updates', 'latest AI developments', or mentions wanting a 'daily AI briefing'.
- Package
- 4 files, 35 KB
- SKILL.md
- 1249 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Daily AI News Briefing · When to Use This Skill · Workflow Overview · Phase 1: Information Gathering · Step 1.1: Fetch from Primary AI News Sources · Step 1.2: Execute Web Search Queries · Step 1.3: Fetch Full Articles · Phase 2: Content Filtering · Filter Criteria · Deduplication Strategy · Phase 3: Categorization · 🔥 Major Announcements
Findings
MEDIUM Transitive Trust Abuse - Following External Web Content Prompt Injectionllm
The skill instructs the agent to fetch content from external websites and web search results, then follow instructions or execute workflows based on that untrusted content. The skill uses mcp__web_reader__webReader to fetch arbitrary web pages and then processes their content without validation. This creates a transitive trust vulnerability where malicious content on fetched websites could inject instructions that the agent would follow.
SKILL.md
Use `mcp__web_reader__webReader` to fetch content from 3-5 major AI news websites... Use `WebSearch` with date-filtered queries... For the top 10-15 most relevant stories from search results: Extract URLs from search results, Use `mcp__web_reader__webReader` to fetch full article contentWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 8.8 KB |
references/news_sources.md | doc | 7.5 KB |
references/output_templates.md | doc | 12 KB |
references/search_queries.md | doc | 6.8 KB |
External hosts referenced
ai.hubtoday.app venturebeat.com artificialintelligence-news.com deepmind.google techcrunch.com www.technologyreview.com www.theverge.com ai.meta.com aiethicsnewsletter.com arxiv.org blog.google blogs.microsoft.com huggingface.co openai.com paperswithcode.com syncedreview.com towardsdatascience.com www.anthropic.com www.kdnuggets.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/daily-ai-news-skill
- Raw scan result: daily-ai-news-scan.json
- Badge for your README:
- Request a re-scan