Telegram News Digest (Lite)

Monitors public Telegram channels via web scraping (t.me/s/*), extracts new messages, generates AI-powered summaries, and delivers structured digests to your...

Things to check before installing: - Clarify the env/metadata mismatch: registry metadata says no env vars are required, but the skill manifest and code expect OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN. If you rely on a hosted LLM gateway, provide a token with appropriate scope; otherwise the code falls back to a local gateway URL and a default token string. - Confirm dependency installation policy: package.json lists npm packages. Ensure the platform will install these packages from trusted registries (or audit/lock the package versions) before running the skill. - Verify where config.yaml will live: the README suggests ~/.openclaw/skills/... but the code reads/writes ./config.yaml relative to the skill working dir. Confirm the runtime path to avoid unexpected writes to your home directory or losing configuration. - Review network permissions: the skill can contact t.me and LLM provider hosts. If you want to limit blast radius, run it in a restricted environment or ensure your OpenClaw gateway token has limited scope. - Legal/TOU considerations: the skill scrapes public Telegram pages; ensure scraping is permitted for the channels you monitor. - Operational test: run the skill in a sandboxed environment with a small channel list and DEBUG enabled to confirm behavior (where files are written, what endpoints are contacted). If you don't want it to call external LLMs, configure a local gateway or run it with network disabled. Given the mismatches (manifest vs registry metadata, package.json without an install spec, and path/documentation inconsistencies), proceed cautiously — these look like sloppy packaging rather than clear malicious intent, but they increase operational risk.

Type: OpenClaw Skill Name: tg-news-digest-lite Version: 1.0.0 The skill is a well-structured Telegram news monitoring tool that scrapes public 't.me/s/' pages and summarizes content using an LLM. It includes robust input normalization and validation in `src/scraper.js` to prevent SSRF or path traversal, and it utilizes the standard OpenClaw context for secure communication and LLM access. The code follows best practices such as rate limiting, atomic state management in `src/storage.js`, and graceful fallbacks in `src/summarizer.js` if the LLM fails. No indicators of malicious intent, data exfiltration, or unauthorized command execution were found.