Sports Science Daily

Automated sports science intelligence engine — fetches 55+ sources (PubMed, expert blogs, wearable tech), filters noise, translates to Chinese, and syncs to...

Do not hand over real Feishu/Notion/Google credentials or run anything yet. The skill bundle contains only documentation (SKILL.md / SKILL_ZH.md) and no code — but its instructions assume a local Python project (main.py, src/, requirements.txt). Before installing or running: - Ask the skill owner for the repository or packaged source and verify the GitHub homepage URL actually hosts the project; review the code yourself or have someone you trust audit it. - Confirm exactly which API keys are required (Google Translate key, Notion token) and why; ensure those env vars are declared and scoped (least privilege). Never paste long-lived credentials into an unverified skill. - Inspect the exporter code (feishu.py, notion.py) to see what data they send and to which endpoints; ensure no unexpected external endpoints exist. - Be cautious about the skill reading/writing local files (processed_history.json): check for any code that might read other filesystem locations or exfiltrate unexpected data. If you cannot obtain the upstream code for review or the author cannot justify the missing/undocumented credential usage, treat this skill as untrusted and do not run it with real credentials. If you want to proceed safely, run it in an isolated environment (throwaway VM/container) with test credentials and network monitoring first.

Type: OpenClaw Skill Name: sport-science-review Version: 1.0.0 The skill bundle appears benign. The `SKILL.md` and `SKILL_ZH.md` files clearly describe an automated sports science intelligence engine that aggregates data, translates it, and syncs it to Feishu/Notion. All declared requirements (Python 3, `feedparser`, `requests`), environment variables (`FEISHU_APP_ID`, `FEISHU_APP_SECRET`, `FEISHU_RECEIVE_ID`, `NOTION_TOKEN`, `NOTION_PAGE_ID`), external APIs (PubMed, Google Translate, Feishu, Notion, RSS feeds), and local file operations (`processed_history.json`, `.md` reports) are directly aligned with the stated purpose. There is no evidence of prompt injection attempts against the agent, unauthorized data exfiltration, malicious execution patterns, or persistence mechanisms within the provided markdown files. The instructions are straightforward and execute a local Python script with declared parameters.