technology-news-search
What this skill does
The skill is a legitimate technology news search tool that aggregates and ranks news from various tech sources, including both global and China-specific platforms. It supports network adaptation, tran
github/netease-youdao - Data Exfiltration - 5.9k stars
Threat analysis
Skill info
pkg:github/netease-youdao/LobsterAI@bef896b?skill=technology-news-searchAssessments (3)
Data Exfiltration
Data Exfiltration via local-llm-review
scripts/search_news.js
The script uses `execFileAsync` and does not explicitly restrict or sanitize the execution of external commands, which could be exploited if the input is not properly sanitized.Insecure Configuration
Insecure Configuration via local-llm-review
scripts/search-news.ps1
The script loads a `.env` file and sets environment variables without explicit validation or sanitization, which could be a risk if the `.env` file contains malicious or insecure configurations.Insecure Configuration via local-llm-review
scripts/search-news.sh
The script sources a `.env` file without explicit validation or sanitization, which could be a risk if the `.env` file contains malicious or insecure configurations.Badge
Add the Anomity scan badge for technology-news-search to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of technology-news-search? Report an issue or request a rescan.
