ai-news-mcp: why it is not safe to use
We found broad runtime fetching, local Claude credential access in self-hosting, and non-interactive cache deletion scripts, so we advise caution.
What we found
Our review did not find hidden prompts, hardcoded secrets, obfuscated code, or signs of privilege escalation in the inspected repository. The warning result came from a narrower set of operational findings.
The skill fetches remote content at runtime from multiple public sources, then uses WebFetch on article URLs gathered from those feeds. That expands network reach beyond the top-level named sources described in the project.
In the self-hosting workflow, the included `run_news_fetcher.sh` script symlinks `$HOME/.claude/.credentials.json` into a temporary Claude config directory. We did not find evidence of those credentials being exfiltrated, but this setup means the workflow accesses local Claude credentials in addition to public news data.
We also found maintenance scripts and prompt steps that delete old cache rows from Supabase without an interactive confirmation prompt. The deletion appears limited to the service's own cache, not user files.
What to do instead
Use this skill only if you are comfortable with its broader runtime fetching behavior and credential-dependent self-hosting setup. For lower-risk use, prefer a news tool that limits outbound fetches to clearly listed domains, avoids linking local credential files into temp environments, and adds confirmation or safer guardrails around cache-deletion operations.
Source: https://github.com/treesoop/ai-news-mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.