← Back to Skills Marketplace
209
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install quotedance-rss-digest
Description
聚合已启用订阅源的RSS资讯，支持按源名关键词过滤，返回最近几天内最新文章的Markdown列表，含本地缓存。
Usage Guidance
这个技能看起来确实实现了它声称的 RSS 聚合功能，但有两点你在安装/使用前应确认：
1) API Key：脚本会使用 X-API-Key 向 quotedance-service 发 /feeds/registry（从 config.json 的 apiKey 或环境变量 QUTEDANCE_API_KEY 读取）。不过技能注册元数据没有声明它需要任何环境变量或主凭证。请在启用前确认你是否愿意把 quotedance-service 的 API Key 放进 skills/quotedance-rss-digest/config.json 或设置 QUTEDANCE_API_KEY 环境变量；如果不想泄露凭据，保持 config.json 中 apiKey 为空并不要设置环境变量。
2) 本地缓存与数据：包里含有 memory/ 下的大量缓存 JSON 文件（已抓取的文章内容）。这些是本地缓存，会被读写到技能目录。如果你不希望这些历史数据存在于技能目录，安装前删除或清空 memory/ 文件夹；运行脚本时也会继续在该目录写缓存。
另外的建议：确认 serviceUrl（默认 https://quotedance.api.gapgap.cc）是否是你信任的服务端点；确认本地 RSSHub 地址（默认 http://localhost:1200）是否按你的期望配置。若你对自动网络访问敏感，可在隔离环境下手动运行 node skills/quotedance-rss-digest/scripts/rss-digest.js 来观察行为，再决定是否允许 Agent 自动调用该技能。
Capability Analysis
Type: OpenClaw Skill
Name: quotedance-rss-digest
Version: 1.0.0
The skill is an RSS aggregator that fetches and caches news feeds, but it includes pre-populated cache files in the `memory/` directory that contain indirect prompt injections. Specifically, `memory/rss-cache-_____-d3-l100.json` contains a simulated news article that explicitly instructs the agent or user to download and install an external skill ("Guardian Claw") from the domain `Claw.myTuanzi.com`. While the Node.js logic in `scripts/rss-digest.js` is functional and does not contain direct malware, the inclusion of these instructional payloads in the bundled data is a classic vector for social engineering or autonomous agent exploitation, aiming to trigger unauthorized software installations.
Capability Assessment
Purpose & Capability
名字与描述（聚合已启用的订阅源、按名称过滤、生成 Markdown、使用本地缓存）与脚本实现一致；它确实需要访问 quotedance-service (/feeds/registry) 和本地 RSSHub，功能范围符合预期。但 registry 元数据未说明需要的 API Key/凭据（见下文）。
Instruction Scope
SKILL.md 明确指示调用 quotedance-service 获取已启用订阅源，再本地逐条抓取 RSS 并缓存，脚本只读写技能内的 config.json 与 memory/ 下的缓存文件并对外发起 HTTP 请求，这与描述一致。需注意 SKILL.md/脚本中会读取 process.env.QUTEDANCE_API_KEY（或 config.json 中的 apiKey），但技能声明中没有列出任何必需的环境变量——这是不一致。
Install Mechanism
无安装脚本／下载行为（instruction-only + 本仓包含实现脚本），不会在安装时从不明 URL 拉取或执行远端代码。唯一的“落盘”是脚本运行时会在技能目录下的 memory/ 写入缓存文件，这是文档中所述的正常行为。
Credentials
脚本在运行时会在请求 quotedance-service 时使用 X-API-Key：它读取 config.json 的 apiKey 或环境变量 QUTEDANCE_API_KEY，但技能的公开要求未声明任何凭据或主凭证。缺乏明确声明会误导用户——在没有显式提示下使用该技能可能会意外向第三方服务发送未获授权的数据或API调用。除此之外没有请求其他不相干的凭据。
Persistence & Privilege
技能不会要求常驻(always)或修改其它技能/系统配置；它会在自身目录下维护缓存文件（memory/），并提供命令行参数清理缓存，权限与持久性在预期范围内。
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install quotedance-rss-digest - After installation, invoke the skill by name or use
/quotedance-rss-digest - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of quotedance-rss-digest:
- Aggregates recent feed articles from your quotedance-service subscriptions using local RSSHub, outputting Markdown summaries.
- Supports filtering by source name keyword (e.g., "only 少数派").
- Includes local caching with configurable TTL for both articles and feed lists.
- Offers CLI script with parameters for days, limit, source filtering, and cache control.
- Configuration via `config.json` for API URLs, keys, defaults, and TTLs.
Metadata
Frequently Asked Questions
What is quotedance-rss-digest?
聚合已启用订阅源的RSS资讯，支持按源名关键词过滤，返回最近几天内最新文章的Markdown列表，含本地缓存。 It is an AI Agent Skill for Claude Code / OpenClaw, with 209 downloads so far.
How do I install quotedance-rss-digest?
Run "/install quotedance-rss-digest" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is quotedance-rss-digest free?
Yes, quotedance-rss-digest is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does quotedance-rss-digest support?
quotedance-rss-digest is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created quotedance-rss-digest?
It is built and maintained by yoocky (@yoocky); the current version is v1.0.0.
More Skills