Scalingup Daily

搜广推领域模型 Scaling Up 日报生成技能。每日自动检索6类优先级信息源（ArXiv论文、微信公众号、知乎、技术博客、GitHub Trending、行业会议），生成结构化日报并写入IMA知识库。触发词：搜广推日报、ScalingUp日报、推荐系统日报、推荐Scaling Law日报、生成式推荐日报、To...

This skill appears to do what it says (scrape the web, assemble a Markdown report, and upload it to IMA and Tencent Docs), but pay attention to the following before installing or enabling automation: - Metadata vs reality: The registry metadata claims no required credentials, yet SKILL.md and scripts require IMA API credentials (~/.config/ima/client_id and api_key) and a configured mcporter/Tencent-Docs token. Treat this mismatch as a red flag — ask the publisher to correct the manifest or don't install until clarified. - Credentials scope: If you decide to use it, create/assign least-privilege IMA credentials (and a limited mcporter token) dedicated to this automation, not your primary production keys. Understand what those credentials can do in IMA/COS and limit them if possible. - Inspect helper code: Review the cos-upload.cjs script (from ima-skills) before running; ima_upload.py will pass transient COS credentials (secret_id/secret_key/token) to that helper. Ensure the helper script is trusted and does not exfiltrate secrets. - Scraping behavior: search_wechat.js intentionally randomizes User-Agent and manipulates cookies/redirects to extract mp.weixin.qq.com links. This may trigger anti-bot defenses or violate terms of service for third-party sites. Consider rate limits, legal/usage implications, and run from an environment where outbound scraping is acceptable. - File access: The uploader enumerates ~/.workbuddy/skills to locate cos-upload.cjs; if you are uncomfortable with that, run the upload step manually or place cos-upload.cjs in a known safe path and update the script. - Test safely: Run a one-off manual test with a throwaway report in a sandboxed account, inspect network calls, and verify uploads succeed before scheduling automatic weekly runs. If you want to proceed, ask the author to update the skill metadata to declare required credentials and tokens explicitly and to document the exact file paths the skill will read. If that cannot be provided, treat the skill as 'untrusted' and run only in an isolated environment with limited credentials.

Type: OpenClaw Skill Name: scalingup-daily Version: 1.0.1 The skill bundle automates technical report generation by scraping ArXiv, WeChat, and Zhihu, then publishing to IMA and Tencent Docs. It exhibits high-risk patterns including reading sensitive API credentials from the user's home directory (~/.config/ima/) and executing shell commands via subprocesses and mcporter (scripts/ima_upload.py, SKILL.md). While these capabilities are aligned with the stated purpose, the architecture creates a significant attack surface for prompt injection or command execution if the AI agent processes untrusted search results into the shell-based publishing pipeline.