Miniflux News

Fetch and triage the latest unread RSS/news entries from a Miniflux instance via its REST API using an API token. Use when the user asks to get the latest Miniflux unread items, list recent entries with titles/links, or generate short summaries of specific Miniflux entries. Includes a bundled script to query Miniflux (/v1/entries and /v1/entries/{id}) using credentials from ~/.config/clawdbot/miniflux-news.json (or MINIFLUX_URL and MINIFLUX_TOKEN overrides).

This skill appears to do exactly what it says: it queries a Miniflux instance and only marks items read when you ask. Before installing, consider: 1) the registry metadata does not list the required MINIFLUX_URL/MINIFLUX_TOKEN or the config path — verify you are comfortable providing an API token to this skill and review the script source (provided) to confirm behavior; 2) prefer creating a read-only/minimum-scope token in Miniflux if possible; 3) the skill will write a plaintext JSON config to ~/.config/clawdbot/miniflux-news.json (it attempts 600 perms) — if you store secrets there, ensure filesystem permissions meet your policy; 4) because the skill's source/homepage/owner are not well-documented, only install if you trust the publisher or after manual review of the included script. If you want higher assurance, ask the publisher for a homepage or signed release, or run the script locally yourself rather than allowing autonomous invocation.

Type: OpenClaw Skill Name: miniflux-news Version: 0.1.0 The skill is benign, designed to interact with a Miniflux RSS reader API. It handles credentials appropriately from a dedicated config file (`~/.config/clawdbot/miniflux-news.json`) or environment variables, without attempting to access unrelated sensitive files or exfiltrate data. The `SKILL.md` explicitly includes a strong safety instruction to the agent, stating that it 'must never mark anything as read implicitly' and requires explicit user confirmation for destructive actions, which is reinforced by a `--confirm` flag in the `miniflux.py` script. The Python script uses only the standard library and performs controlled HTTP requests to the Miniflux API, with no evidence of malicious execution patterns or obfuscation.