Generates in-depth weekly AI/Computer Vision reports by aggregating data from multiple sources with plugin-based pipeline and multi-channel delivery.

What to check before installing or running this skill: - Purpose mismatch: The registry name/description ('Ai Cv Weekly') is narrow, but the bundle is a generic briefing engine (ClawCat) with many adapters (news, finance, search), rendering (Playwright), and pipeline components. If you only want a CV‑focused weekly, ask the publisher or inspect registry.json/config to ensure only the intended sources are enabled. - Network activity: The code fetches data from many public endpoints (news APIs, search engines, social feeds). Expect outbound HTTP(S) traffic; run in an environment where that is acceptable. - Playwright and system deps: The repo uses Playwright for HTML→PDF/PNG. Playwright requires a browser runtime (Chromium) and may need extra installation. Confirm system requirements before running. - LLM API keys: Standalone mode requires an LLM API key in config.local.yaml or env; only provide keys if you trust the skill and run it in a controlled environment. In host-skill mode (plan_report/fetch_data/render_report), no key is required by the skill itself. - skill_proxy / dynamic import risk: The adapters include a skill_proxy adapter that can bridge to other skill modules by name. Check registry.json for any entries that import external or unexpected modules — arbitrary import/call can expand what code executes when fetch_data runs. - Review registry.json and adapters: Inspect which sources are enabled by default and any adapter code that posts or forwards data. The repo is large but readable; scan the adapters you expect to use. - Run in a sandbox first: Execute the CLI or host calls in an isolated/testing environment to observe network calls, filesystem writes, and any browser activity before enabling in production. - Provenance: The skill owner/source is unknown and there is no homepage. If provenance matters for your use, ask the publisher for clarification or prefer a skill with clear author/source. If you want, I can: - Extract and summarize registry.json and which data sources are enabled by default. - List runtime Python dependencies and any system-level requirements (e.g., Playwright browsers) from requirements.txt. - Point out places in the code to edit if you want to restrict sources or disable Playwright rendering.

Type: OpenClaw Skill Name: ai-cv-weekly Version: 7.0.1 The skill bundle is a highly engineered AI briefing engine that uses LangGraph and the instructor library to generate structured reports. It is classified as suspicious due to the implementation of 'clawcat/adapters/search/skill_proxy.py', which uses importlib to dynamically load and execute functions from arbitrary Python modules based on configuration provided by the LLM-driven planner. This creates a significant attack surface for Remote Code Execution (RCE) if the planner agent is manipulated via prompt injection to load sensitive modules (e.g., 'os' or 'subprocess'). While this functionality is documented as a bridge for external skills, the lack of a module whitelist or sandboxing for these dynamic imports is a high-risk vulnerability. The remainder of the bundle, including robust hallucination checks in 'clawcat/grounding/', appears benign and aligned with the stated purpose.