Trend Tap

Real-time trending topics aggregator across 7 platforms (X/Twitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'tre...

This skill appears coherent and implements what it claims: it scrapes public sources using Python and requires no API keys. Before installing or enabling scheduled runs, review and approve the scheduler behavior (it writes entries to your user crontab and creates daily files under ~/.openclaw/trend-tap/daily/). If you don't want automated scheduling, avoid running scheduler.py --set. Also review the code if you have concerns about scraping frequency or the hard-coded Weibo cookie header; otherwise there are no unexplained credential requests or hidden network endpoints.

Type: OpenClaw Skill Name: trend-tap Version: 2.0.0 The skill provides legitimate trending topic aggregation but includes high-risk system persistence capabilities in 'scripts/scheduler.py', which modifies the user's crontab using subprocess calls. This script lacks input sanitization for the cron expression, creating a potential command injection vulnerability if malformed strings are provided. Additionally, 'scripts/sources/weibo.py' contains a hardcoded session cookie (SUB=...) to bypass access controls, which is a risky practice. While these behaviors align with the stated features (daily briefings and scraping), the direct manipulation of system configuration files and lack of input validation warrant a suspicious classification.