AI tool that generates structured news digests from Twitter and RSS feeds with summaries available in 4-hour, daily, weekly, or monthly formats.

What to check before installing/running ClawFeed: - Metadata vs code: The registry claims an 'instruction-only' skill with no env vars, but the repository contains a runnable Node server and DB migrations. Treat this as a small web app you will be starting locally (not just a prompt file). - Secrets required: SKILL.md expects GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET, SESSION_SECRET, and API_KEY for write endpoints. Do not supply these credentials to the skill unless you trust the source. The registry omitted these — ask the publisher why. - LLM / external API ambiguity: The docs describe AI summarization but do not list which LLM provider or API keys (OpenAI, Anthropic, self-hosted) are used. Inspect src/server.mjs and code paths that perform summarization to see whether the app makes outbound calls and to which hosts before running. - Network exposure & persistence: npm start will run a server (default port 8767) and create a local SQLite DB. Run it in an isolated environment (container, VM) and bind it to localhost only if you do not want it reachable from the network. - Native build: better-sqlite3 is a native addon; npm install will compile / download binaries. Ensure build tools are acceptable in your environment. - Review code: Because full source is included, scan src/server.mjs and src/db.mjs for any hidden outbound endpoints, telemetry, or code that reads unexpected config paths. Look for any hard-coded URLs/webhooks (e.g., feedback webhook) before providing credentials. If you want higher confidence: request the publisher to update registry metadata to declare required env vars and an install spec, and to document the LLM/provider used. If you cannot audit the code, run the service in a container/VM and restrict network access until you confirm behavior.

Type: OpenClaw Skill Name: clawfeed-3 Version: 0.1.0 ClawFeed is a well-documented and professionally structured AI-powered news digest tool. The bundle contains a Node.js server (src/server.mjs), SQLite database logic (src/db.mjs), and an extensive end-to-end test suite (test/e2e.sh). Security best practices are evident, including robust SSRF protection in the URL resolver (assertSafeFetchUrl in src/server.mjs), HMAC-signed OAuth state validation, and the use of prepared statements to prevent SQL injection. No evidence of data exfiltration, malicious backdoors, or prompt injection attacks was found; the code logic is entirely consistent with the stated purpose of curating and summarizing news feeds.