tech-news-bulletin

Collect latest technology and AI news from RSS feeds AND the TLDR.tech AI newsletter, merge them into a unified daily digest, and send via email.

Before installing or running this skill, consider the following: - Do not run it unmodified. The shipped script contains a hardcoded list of recipient emails; if you run it as-is the digest will be emailed to those addresses. Replace or remove EMAIL_ADDRESSES before use. - The registry metadata omitted required env vars, but SKILL.md and the script expect SMTP_EMAIL and SMTP_PASSWORD. Ensure you set an appropriate SMTP account with limited permissions (use an app-specific password or a dedicated sending account) and never reuse a high-privilege credential. - The summarization request is POSTed to a hardcoded internal IP (http://172.20.86.203:11434). That endpoint will receive the article text (up to the truncated length the script sends). If you don't control/recognize that host, do not run the summarization or change the code to point to a trusted model endpoint or disable remote summarization. - The script logs to /tmp/openclaw-debug.log and SKILL.md suggests running a command at a hardcoded home path (/home/juniarto/...). Update paths to your environment to avoid accidental disclosure of your filesystem layout or relying on author-specific paths. - Audit the code paths that fetch pages (tldr.tech, RSS feeds) and the summarizer call, and consider running the script in an isolated environment (container or VM) until you are comfortable with its behavior. - If you need this functionality but want to minimize risk: remove the hardcoded recipients, make the Ollama endpoint configurable via environment variables (and default to disabled), and verify the SMTP usage with a disposable sending account. Given the hardcoded recipients and the non-configurable internal summarization endpoint, treat this skill as potentially leaking content unless you explicitly review and modify those parts.

Type: OpenClaw Skill Name: tech-news-bulletin Version: 1.0.0 The skill contains hardcoded recipient email addresses belonging to a specific organization (a-star.edu.sg) and a hardcoded internal IP address (172.20.86.203) for the Ollama summarization service in scripts/bulletin.py. Although the SKILL.md documentation notes that these should be customized, the default configuration poses a data leakage risk by sending news digests to the hardcoded addresses and relies on a non-public network resource. This behavior suggests an improperly sanitized internal tool that could lead to unintended information disclosure if executed without modification.