Noticias Cangrejo

Fetch and summarize recent news articles from GNews on any topic, generating a concise Markdown digest with date, greeting, and top links.

This skill appears to be what it claims: it will read only your GNEWS_API_KEY, call the official GNews API endpoint (gnews.io), produce a Markdown digest, and optionally write that digest to a file you specify. Before installing, ensure you: (1) are comfortable providing a GNews API key to this skill and keep that key stored securely (do not paste it into chat), (2) understand GNews rate limits/charges and avoid exposing the key to public repos, and (3) review the small Python script if you want to verify there is no additional outbound behavior. Note: there is a minor metadata/version mismatch (registry shows 1.0.4 while _meta.json reports 1.0.1), which looks like a packaging oversight but not a functional security issue.

Type: OpenClaw Skill Name: noticias-cangrejo Version: 1.0.4 The skill's core functionality is benign, fetching and summarizing news. However, the `scripts/fetch_news.py` script is vulnerable to path traversal via the `--output` argument. It allows writing the news summary to an arbitrary file path without sanitization, which could enable an attacker to overwrite or create files in sensitive locations if they can control the input to this argument. This is a significant vulnerability, but there is no evidence of intentional malicious behavior within the script itself.