Signal Pipeline

Marketing intelligence pipeline - gather signals from RSS, X/Twitter, Telegram, and Gmail newsletters. Generate daily posts, weekly summaries, and monthly de...

Before installing or running: 1) Expect to configure and authorize a 'gog' CLI for Gmail — the skill does not declare that requirement; avoid giving Gmail access if you don't trust the code. 2) Inspect and change hardcoded paths (e.g., /Users/jarvis/.openclaw/workspace/memory/daily_signals/) — those will write into a specific user's home / agent workspace and may persist or be uploaded by the platform. Use a safe, explicit data directory you control. 3) Run the code in a sandboxed environment (isolated VM or container) because it performs web requests (t.me, fxtwitter, sogou) and writes local databases. 4) Consider replacing subprocess.run(..., shell=True) with a safer invocation or verify queries are static (newsletter_monitor uses static queries in code). 5) If you will grant Gmail access, review newsletter_monitor.py carefully to confirm only expected data (subject/sender/date) is extracted and that nothing is exfiltrated to external endpoints. 6) If you want to proceed, update SKILL metadata to declare required binaries (gog) and document Gmail credential needs; remove or parameterize absolute file paths so the skill is not implicitly writing into agent memory.

Type: OpenClaw Skill Name: signal-pipeline Version: 1.1.0 The skill is classified as suspicious primarily due to a shell injection vulnerability in `newsletter_monitor.py`. This file uses `subprocess.run(shell=True)` with an f-string to construct a command for the `gog` CLI, which could allow arbitrary command execution if the `query` parameter were to be influenced by untrusted input. Although the current `NEWSLETTERS` list contains hardcoded queries, the use of `shell=True` with string interpolation is a significant security flaw. Additionally, `daily_signals.py` contains hardcoded paths like `/Users/jarvis/.openclaw/workspace/memory/daily_signals/` for saving and loading data, which is a vulnerability that could lead to errors or unintended file operations on different systems or user configurations.