← Back to Skills Marketplace
News Briefing
by
derekhsu529
· GitHub ↗
· v2.0.0
444
Downloads
0
Stars
9
Active Installs
1
Versions
Install in OpenClaw
/install news-briefing
Description
Real-time AI news briefing for any topic. Say "给我看大谷翔平的新闻" or "AI今天有什么大新闻", and your agent instantly searches the web, summarizes the top stories in Chinese,...
Usage Guidance
This skill appears to do what it claims: search Perplexity, optionally call PPIO for insights, and post formatted cards to Feishu. Before installing or running it, consider: 1) You must provide FEISHU and PERPLEXITY (and optionally PPIO) API keys — grant least privilege and avoid using high-priv production credentials until you trust it. 2) The scripts use execSync and shell-constructed curl commands, which can be brittle and risk command injection if untrusted input is fed into the CLI; prefer running with controlled topic strings or sanitizing inputs. 3) gen-cover uses hard-coded system paths (pnpm global path, /root workspace, system fonts) and may fail or behave unexpectedly; run cover generation in a sandbox or skip it if you don't need images. 4) Test in a safe environment and verify Feishu messages go only to intended recipients (use dry-run and TARGET_USER_ID) before enabling scheduled runs with real credentials.
Capability Analysis
Type: OpenClaw Skill
Name: news-briefing
Version: 2.0.0
The skill bundle provides legitimate news briefing functionality but contains significant security vulnerabilities. Multiple scripts (fetch-news.mjs, news-digest.mjs) use 'child_process.execSync' to construct shell commands via string concatenation with user-supplied inputs (like 'topic'), creating a high risk of shell injection. While the behavior aligns with the stated purpose of fetching news via Perplexity and sending Feishu cards, the lack of input sanitization and the use of hardcoded system paths in 'gen-cover.mjs' are risky practices.
Capability Assessment
Purpose & Capability
The SKILL.md description (real-time news search, Chinese summaries, Feishu cards) matches the code: fetch-news calls Perplexity, optional PPIO for insights, and send-card posts to Feishu. Required secrets in the README (FEISHU_APP_ID/SECRET, PERPLEXITY_API_KEY, optional PPIO_API_KEY) are exactly those the scripts use. Minor inconsistency: registry metadata listed 'Required env vars: none' while SKILL.md and scripts do require keys.
Instruction Scope
Instructions and scripts stay within the advertised scope (search, summarize, generate insight, send card). The code performs network calls to specified third-party APIs and writes/reads local files for outputs. Notable implementation concerns: many network calls are executed via shell (execSync + curl), which can be fragile and create command-injection risks if untrusted inputs are passed into shell commands; gen-cover writes to a root workspace path and constructs a large node -e command that embeds code, which is brittle and may execute unexpectedly in some environments.
Install Mechanism
No install spec (instruction-only), so nothing is automatically downloaded during install — lower risk. However, scripts assume Node and curl are available and gen-cover references a hard-coded pnpm/global module path for @napi-rs/canvas and system font paths; that is brittle and may fail or require manual dependency setup. There is no external archive URL or obscure downloader in the manifest.
Credentials
Requested environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET, PERPLEXITY_API_KEY, optional PPIO_API_KEY, HTTPS_PROXY, TARGET_USER_ID) are proportional to the stated functionality. The code only uses these variables and standard HTTP proxy vars; it does not request unrelated credentials.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or global configs. It writes a cover image into its own workspace path and otherwise runs as ephemeral scripts — no unusual persistence or elevated privileges are requested.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install news-briefing - After installation, invoke the skill by name or use
/news-briefing - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.0
全新发布：私人情报官定位，联网实时+AI深度洞察+飞书卡片，任意话题一句话触发，全程中文输出
Metadata
Frequently Asked Questions
What is News Briefing?
Real-time AI news briefing for any topic. Say "给我看大谷翔平的新闻" or "AI今天有什么大新闻", and your agent instantly searches the web, summarizes the top stories in Chinese,... It is an AI Agent Skill for Claude Code / OpenClaw, with 444 downloads so far.
How do I install News Briefing?
Run "/install news-briefing" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is News Briefing free?
Yes, News Briefing is completely free (open-source). You can download, install and use it at no cost.
Which platforms does News Briefing support?
News Briefing is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created News Briefing?
It is built and maintained by derekhsu529 (@derekhsu529); the current version is v2.0.0.
More Skills