Mzu 每日简报 · News Briefing

Multi-source AI/Tech news aggregator with intelligent daily briefings. Covers AI, technology, finance, and world events — with hot/cold ranking and source at...

This skill appears to do what it says (an aggregator) but there are two things to consider before installing: (1) SKILL.md requires sensitive credentials (Twitter auth_token + ct0 or a Grok API key), yet the registry metadata lists none — ask the publisher to update the metadata so you know what you'll be asked to provide. (2) The instructions tell you to copy browser cookies into a plaintext file and export them into the agent environment. That is functionally necessary for using the bird CLI route but is risky: those tokens can be abused if leaked. If you proceed, prefer using the Grok API key route (less invasive), restrict file permissions (chmod 600), store keys in a secure secrets manager if possible, and consider creating a dedicated or limited-permission account for the Twitter route. Also verify the origin of agent-reach and @steipete/bird packages (check PyPI/NPM pages and maintainers) before running installs. If you need higher assurance, ask the skill author to declare required env vars in the registry and provide guidance for secure storage/rotation of tokens.

Type: OpenClaw Skill Name: mzu-news-briefing Version: 1.1.4 The skill implements a news aggregator that requires high-risk credential handling, instructing users to store sensitive Twitter session cookies (auth_token, ct0) and API keys in plaintext files (~/.agent-reach-twitter.env and ~/.grok-api-key). The SKILL.md file explicitly directs the AI agent to read these secrets and use them in shell commands via the bird CLI and curl. While the logic appears aligned with the stated purpose of news aggregation, the practice of granting an AI agent direct access to session-level credentials via local files is a significant security risk that could be exploited for data exfiltration if the agent's instructions are subverted.