Skill Trust Decision
trading-news-guard
纯文档型技能存在声明与实际不符：SKILL.md声称「100%本地无网络」，但skill-card.md提及API检查，文档间存在歧义且无实际代码实现。
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
2 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
文档声明不一致 +20
SKILL.md声明无网络调用，skill-card.md提及API检查存在歧义
空章节残留 +8
SKILL.md含空的 Payment 章节，可能遗留文档
无可执行代码 +7
无脚本文件，仅为文档型技能
缺少实现细节 +7
skill-card.md明确指出无工作命令或数据源
Most important evidence
Medium Doc Mismatch
文档间声明不一致
SKILL.md元数据和开篇声称「100% lokal reference — ingen netværkskald, ingen API-nøgle」（无网络调用、无API密钥），但skill-card.md的描述中提及「API-based status checks」，两者存在直接矛盾。
SKILL.md:1, skill-card.md:1 统一文档声明，明确数据来源是本地还是API
Medium Doc Mismatch
缺少可执行代码
skill-card.md明确指出「no working command or data source is included」，此技能仅为文档指导，不含可执行逻辑
skill-card.md:35 在获得可验证实现前勿用于生产环境
Low Doc Mismatch
空章节残留
SKILL.md含空的 ## Payment 章节，可能是文档模板遗留
SKILL.md:35 删除未使用的章节以保持文档清晰
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred NONE
N/A - 纯文档型技能 Network Pass
Declared NONE
→ Inferred UNKNOWN
SKILL.md:1 声称100%本地无网络调用，但skill-card.md提及API检查 Shell Pass
Declared NONE
→ Inferred NONE
N/A - 纯文档型技能 Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/user/northcap-group skill-card.md:9
Medium External URL
https://clawhub.ai/northcap-group/skills/trading-news-guard skill-card.md:35
Dependencies and supply chain
There are no structured dependency warnings.
File composition
2 files · 114 lines
Markdown 2 files · 114 lines
Files of concern · 2
skill-card.md 缺少可执行代码 · https://clawhub.ai/user/northcap-group · https://clawhub.ai/northcap-group/skills/trading-news-guard
SKILL.md 空章节残留
Security positives
无代码执行，无直接恶意行为
包含 fail-closed 设计建议（API不可达时视为blackout）
MIT-0 许可证，条款宽松
skill-card.md 主动披露了已知风险