Tech News Digest

This skill failed 2 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

• No undeclared network calls: failed

  Contacts 89 hosts that are neither well-known infrastructure nor declared in the skill's frontmatter: 36kr.com, a.com, a16zcrypto.substack.com, aisnakeoil.substack.com, antirez.com….

  Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  Hosts contacted

  simonwillison.netundeclaredgarymarcus.substack.comundeclaredhuggingface.comodel provideropenai.comundeclaredmagazine.sebastianraschka.comundeclaredlilianweng.github.ioproject documentationgwern.substack.comundeclaredwww.dwarkeshpatel.comundeclaredminimaxir.comundeclaredblog.googleundeclaredvitalik.eth.limoundeclaredwww.coindesk.comundeclaredwww.theblock.coundeclareddecrypt.coundeclaredcointelegraph.comundeclaredhnrss.orgundeclaredfeeds.arstechnica.comundeclaredtechcrunch.comundeclaredwww.theverge.comundeclaredkrebsonsecurity.comundeclareddaringfireball.netundeclaredwww.aaronsw.comundeclaredwww.troyhunt.comundeclaredantirez.comundeclaredmitchellh.comundeclaredgeohot.github.ioproject documentationwww.reddit.comundeclared36kr.comundeclaredwww.jiqizhixin.comundeclaredwww.qbitai.comundeclaredwww.infoq.cnundeclaredwww.technologyreview.comundeclaredventurebeat.comundeclaredwww.404media.coundeclaredaisnakeoil.substack.comundeclaredblog.bytebytego.comundeclaredblogs.nvidia.comundeclareddeepmind.googleundeclaredwww.producthunt.comundeclaredmessari.ioundeclaredthedefiant.ioundeclaredwww.ifanr.comundeclaredsspai.comundeclaredwww.wired.comundeclaredspectrum.ieee.orgundeclaredwww.bensbites.comundeclareda16zcrypto.substack.comundeclaredwww.bankless.comundeclaredoverreacted.ioundeclaredeli.thegreenplace.netundeclaredmatklad.github.ioproject documentationlucumr.pocoo.orgundeclareddevblogs.microsoft.comundeclaredrachelbythebay.comundeclaredxeiaso.netundeclaredpluralistic.netundeclaredlcamtuf.substack.comundeclaredbuttondown.comundeclareddynomight.netundeclaredwww.geoffreylitt.comundeclaredfabiensanglard.netundeclaredwww.youtube.comundeclaredexport.arxiv.orgundeclaredresearch.googleundeclaredwww.microsoft.comundeclaredbair.berkeley.eduundeclaredwww.interconnects.aiundeclaredwww.latent.spaceundeclaredimportai.substack.comundeclaredthezvi.substack.comundeclaredwww.oneusefulthing.orgundeclaredwww.techmeme.comundeclaredwww.theregister.comundeclaredlobste.rsundeclaredthenewstack.ioundeclareddeveloper.nvidia.comundeclaredblog.cloudflare.comundeclaredchangelog.comundeclaredwww.schneier.comundeclaredwww.chinatalk.mediaundeclaredwww.w3.orgstandardsapi.github.comsource hostgithub.comsource hostoauth.reddit.comundeclaredapi.x.comundeclaredapi.twitterapi.ioundeclaredapi.getxapi.comundeclaredtwitter.comundeclaredx.comundeclaredapi.search.brave.comundeclaredapi.tavily.comundeclaredcdn.jsdelivr.netundeclared127.0.0.1locala.comundeclaredb.comundeclaredc.comundeclaredreddit.comundeclared

  What it found (3 of 115)

  • config/defaults/sources.json:10contacts simonwillison.net

    "url": "https://simonwillison.net/atom/everything/",

  • config/defaults/sources.json:24contacts garymarcus.substack.com

    "url": "https://garymarcus.substack.com/feed",

  • config/defaults/sources.json:50contacts openai.com

    "url": "https://openai.com/blog/rss.xml",

• No credential access: failed

  Touches credential material in 1 place.

  Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  What it found

  • SKILL.md:554instructs the agent to access ssh private keys or config(in the instructions, not code)

    Scripts do **not** directly read `~/.config/`, `~/.ssh/`, or any credential files. All API tokens are read from environment variables declared in the skill met…

• Declares what it does: passed

  SKILL.md parses and declares a name and a description.

  SKILL.md exists, its frontmatter parses, and it declares a name and a description.

• No obfuscated payloads: passed

  No encoded or obfuscated payloads.

  No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

• No pipe-to-shell installers: passed

  No pipe-to-shell or download-and-run installers.

  No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

• Pinned to a commit: passed

  Scanned draco-agent/tech-news-digest at c3aeafb940.

  The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit

c3aeafb940

Manifest

SKILL.md

Scanned

43 files, 13,698 lines