← Back to Skills Marketplace
2855
Downloads
3
Stars
38
Active Installs
1
Versions
Install in OpenClaw
/install ai-daily-digest
Description
Fetches RSS feeds from 90 top Hacker News blogs (curated by Karpathy), uses AI to score and filter articles, and generates a daily digest in Markdown with Ch...
Usage Guidance
Install only if you are comfortable providing an AI API key, sending RSS article titles/descriptions/URLs to Gemini or your configured OpenAI-compatible provider, and having the Gemini key saved locally in `~/.hn-daily-digest/config.json`. Prefer a restricted or low-billing-limit key, avoid using this on shared machines, delete the config file when done, and do not set `OPENAI_API_BASE` to an endpoint you do not trust.
Capability Analysis
Type: OpenClaw Skill
Name: ai-daily-digest
Version: 1.0.0
The skill bundle is classified as suspicious due to several critical vulnerabilities, primarily shell injection and prompt injection against the LLM. In `SKILL.md`, the agent is instructed to export user-provided API keys (`GEMINI_API_KEY`, `OPENAI_API_KEY`) directly into shell commands without proper sanitization, creating a direct Remote Code Execution (RCE) risk. Additionally, the `scripts/digest.ts` code embeds untrusted article titles and descriptions from RSS feeds directly into prompts for the AI model, making the LLM vulnerable to prompt injection attacks. A path traversal vulnerability also exists in `scripts/digest.ts` if a user-controlled `--output` path is not properly sanitized, allowing arbitrary file writes.
Capability Assessment
Purpose & Capability
The artifacts coherently implement an AI RSS digest: they fetch a fixed list of public RSS feeds, score and summarize articles with Gemini or an OpenAI-compatible provider, and write a Markdown report.
Instruction Scope
The /digest workflow is user-invoked and asks for parameters, but it also directs the agent to save and later reuse configuration including an API key.
Install Mechanism
There is no hidden installer, but execution uses `npx -y bun`, which can download and run the Bun runtime at use time; this is disclosed in the skill instructions.
Credentials
Network access to RSS feeds and AI APIs is proportional to the digest purpose. The custom `OPENAI_API_BASE` option is disclosed and useful for compatible providers, but users should only set it to a provider they trust.
Persistence & Privilege
The skill explicitly writes `geminiApiKey` to `~/.hn-daily-digest/config.json` as plaintext and reuses it later. That credential persistence is disclosed, but it lacks clear opt-in security warning, permission hardening, or use of a secure secret store.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install ai-daily-digest - After installation, invoke the skill by name or use
/ai-daily-digest - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: RSS feeds from 90 top HN blogs, AI-scored daily digest with Chinese translation and visual stats
Metadata
Frequently Asked Questions
What is AI Daily Digest?
Fetches RSS feeds from 90 top Hacker News blogs (curated by Karpathy), uses AI to score and filter articles, and generates a daily digest in Markdown with Ch... It is an AI Agent Skill for Claude Code / OpenClaw, with 2855 downloads so far.
How do I install AI Daily Digest?
Run "/install ai-daily-digest" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is AI Daily Digest free?
Yes, AI Daily Digest is completely free (open-source). You can download, install and use it at no cost.
Which platforms does AI Daily Digest support?
AI Daily Digest is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created AI Daily Digest?
It is built and maintained by royxiao08 (@royxiao08); the current version is v1.0.0.
More Skills