创造者情报 V5 - 工程师视角技术情报聚合器 严禁 VC 商业化话术，只关注底层技术实现。 服务对象：硬科技工程师、极客产品经理、技术研究者。 核心选品标准（按优先级）： 1. 🥇 GitHub 开源项目与霸榜（新模型、新硬件图纸、开发工具库） 2. 🥈 硬核技术原理解析（MoE、稀疏注意力、流匹配、新架构） 3. 🥉 极客硬件与创新交互（ESP32、树莓派、Kickstarter 创意硬件） 摘要必须包含： - 至少 2 个技术名词或具体参数 - 架构/算法/材料/性能指标 - 严禁："拓展商业化"、"规模化部署"、"生态布局" 等公关套话 信源分布： - 国际：GitHub、IEEE、arXiv、Kickstarter、Hackaday（Tavily API 搜索） - 国内：机器之心、量子位、开源中国 RSS 使用场景： - "生成今日技术情报" - "有什么硬核技术新闻" - "GitHub 上有啥新东西" 输出格式： ``` [YYYY-MM-DD] 创造者情报 🌍 📦 [技术实体 + 动作 + 性能参数](URL) 摘要：架构细节；关键性能指标；应用场景 ⚛️ [技术实体 + 动作 + 性能参数](URL) 摘要：... ```

What to consider before installing: - Filename mismatch: SKILL.md refers to scripts/generate_intel.py but the repository provides scripts/generate_brief.py. Ask the author to confirm which script is authoritative and provide a matching README or corrected files. - Hardcoded API key: the Python file contains a hardcoded TAVILY_API_KEY value. Treat this as suspicious until you verify its origin. Do not assume it is safe — it may be a disposable/dev key or someone else's credential. Prefer that the skill read the API key from an environment variable (declared in the skill metadata) rather than embedding it in code. - Undeclared credential: the skill metadata lists no required env vars, but the code calls an external API with a key. Ask the author to declare required credentials so you can manage/rotate them properly. - Network behavior: the skill makes POST requests to api.tavily.com and fetches RSS feeds. If you plan to run this skill, run it in a restricted environment or sandbox and monitor outbound connections until you confirm expected behavior. - Storage: the skill writes history to ~/.openclaw/creator-intel/history.json. If that is sensitive in your environment, run with a different HOME or modify the path. Recommended actions: 1) Request corrected files and an explanation of the hardcoded key from the publisher. 2) Refuse to use the embedded key; configure your own Tavily API key via an env var and ask the author to update the code to read from the env var (and update skill metadata to require it). 3) If you already used the embedded key, consider it compromised and rotate it with the Tavily service. 4) Run the skill first in a sandboxed account and monitor network calls and created files. Confidence note: medium — the behavior fits a news-aggregator, but the metadata/code inconsistencies and embedded credential are clear red flags that warrant verification before trusting or enabling autonomous runs.

Type: OpenClaw Skill Name: creator-intel-v5 Version: 1.0.0 The skill is classified as suspicious primarily due to the hardcoded Tavily API key (`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`) found in `scripts/generate_brief.py`. While the `SKILL.md` instructs users to replace it, shipping a skill with a hardcoded API key, even a development one, is a significant security vulnerability and poor practice. The skill also instructs the agent to set up a cron job for persistence via `openclaw cron add` in `SKILL.md`, which, while documented and intended to run the skill's own script, represents a risky capability if not properly secured by the platform.