Rss Aggregator

Parse, aggregate and process RSS/Atom feeds. Use when user wants to track multiple RSS feeds, create personalized news digest, monitor blog updates, or build...

This skill is functionally coherent for aggregating feeds, but review the following before using: 1) The script disables TLS certificate verification (ctx.check_hostname=False; ctx.verify_mode=ssl.CERT_NONE). That makes feed downloads vulnerable to man-in-the-middle attacks — consider removing those lines so certificates are validated. 2) The code uses Python's xml.etree.ElementTree without explicit protections; consider using a hardened XML parser (e.g., defusedxml) to prevent XML external entity (XXE) issues. 3) The script will fetch any URL you provide (including internal network addresses); avoid pointing it at sensitive internal endpoints or run it in a restricted/containerized environment. 4) SKILL.md examples use external notification tools (telegram-send) — ensure any notification integrations are configured safely and you understand what data will be transmitted. If you want to proceed, run this in an isolated environment, sanitize feed lists, and patch the TLS/XML issues first.

Type: OpenClaw Skill Name: rss-agg Version: 1.0.0 The RSS aggregator skill contains significant security vulnerabilities in `scripts/aggregator.py`. Specifically, the script explicitly disables SSL certificate verification (`ssl.CERT_NONE`), which exposes the agent to Man-in-the-Middle (MitM) attacks when fetching remote feeds. Furthermore, the use of the standard `xml.etree.ElementTree` library to parse untrusted XML data from the internet presents a risk of XML External Entity (XXE) attacks. While these are critical vulnerabilities, they lack clear evidence of intentional malice or data exfiltration.