Simple news feed reader (RSS)

Fetch latest news headlines from major RSS feeds (BBC, Reuters, AP, Al Jazeera, NPR, The Guardian, DW). No API keys required.

The script itself is straightforward and appears to do only what the description says: fetch and parse RSS feeds using Python stdlib. Before installing: 1) Inspect and remove or ignore the .claude/settings.local.json file if you don't want the extra WebSearch/Bash/git permissions applied by your agent environment. 2) Note that the AP feed points to rsshub.app (a third‑party aggregator) — if you prefer canonical feeds, replace that URL. 3) The script makes outbound HTTP requests to the listed news domains, so run it in an environment where outbound network access is acceptable. 4) If you want extra assurance, run the script locally in a sandbox or review/execute it manually rather than allowing autonomous agent invocation. These steps will reduce risk and align the skill's runtime permissions with its simple purpose.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The core Python script (`scripts/news.py`) and the skill instructions (`SKILL.md`) appear benign, focused on fetching and displaying news from RSS feeds using only standard libraries. However, the `.claude/settings.local.json` file grants unnecessary and broad Bash permissions, specifically `Bash(git add:*)`, `Bash(git commit:*)`, and `Bash(tree:*)`. These permissions are not required for a news-fetching skill and introduce a significant security risk, as they could be exploited by a prompt injection or a modified skill to perform unauthorized actions like modifying the repository or listing sensitive file structures.