키워드 기반 뉴스 수집 및 3줄 요약 에이전트

What to consider before installing/running: - Metadata mismatch: The registry lists no required environment variables or install steps, but the package includes package.json/package-lock and the README says to create a .env and run npm install. Treat the skill as code you must install and run (not an instruction-only skill). - Required secrets: The program expects API keys for Tavily (web search) and one or more LLM providers (Groq/GROQ_API_KEY, Anthropic/ANTHROPIC_API_KEY, Google/GOOGLE_API_KEY). Provide only keys with minimal permissions and consider using limited/throwaway keys for testing. - Review .env: The code explicitly reads ../.env; inspect that file for secrets before running. Run in an isolated environment (container) until you are confident. - Network calls: The agent will call external APIs (Tavily, Groq/Groq API base, Anthropic, Google). If you need to audit traffic, run it in a network-restricted environment or with logging/proxy to monitor endpoints. - Logging/privacy: The code prints debug messages about whether keys are present. Consider removing or reducing debug logging to avoid leaking environment state in shared logs. - Prompt behavior: The analyzer enforces strict system prompts that require pure JSON output. This is expected for parsing but can fail or produce unexpected output; validate parsed JSON and handle failures safely. - Next steps: If you plan to use this skill, ask the publisher to update registry metadata to declare required env vars and install steps, audit package.json dependencies, and consider running npm install/build in a sandbox (or review and build the code yourself) before providing real API keys.

Type: OpenClaw Skill Name: agent-news-digest Version: 1.0.0 The NewsDigest Agent is a standard implementation for collecting and summarizing news using the Tavily search API and various LLM providers (Anthropic, Gemini, Groq). The code follows expected patterns for an AI agent, including structured prompts for JSON output and modular LLM adapters in the `src/llm/` directory. No evidence of data exfiltration, malicious execution, or prompt injection was found across the source files or documentation.