News Aggregator Skill

Comprehensive news aggregator that fetches, filters, and deeply analyzes real-time content from 8 major sources: Hacker News, GitHub Trending, Product Hunt, 36Kr, Tencent News, WallStreetCN, V2EX, and Weibo. Best for 'daily scans', 'tech news briefings', 'finance updates', and 'deep interpretations' of hot topics.

This skill's instructions assume there is a local script (scripts/fetch_news.py) and template files, but the package contains only SKILL.md — nothing to run. Before installing or invoking it, consider: 1) Ask the publisher for the missing scripts and templates or for a trusted source/repository URL so you can review the code. 2) If you must run it, run in a sandboxed environment (network- and filesystem-restricted) so the agent cannot fetch arbitrary code or read unrelated files. 3) Review any scripts (fetch_news.py, templates.md) yourself for scraping behavior, third-party libraries, and any places that might exfiltrate data. 4) Be aware it will download and extract article content (--deep) and save reports to disk; ensure you are comfortable with storing potentially copyrighted or sensitive content. 5) If you cannot obtain or inspect the missing files, do not enable the skill — the mismatch between description and required runtime files is a legitimate red flag.

Type: OpenClaw Skill Name: news-aggregator-skill-2 Version: 0.1.0 The skill is classified as suspicious due to several risky capabilities, even though they are presented as part of the skill's stated purpose. The `SKILL.md` instructs the agent to perform 'deep fetching' using `python3 scripts/fetch_news.py --deep`, which involves downloading and extracting content from external, potentially untrusted, news sources. This introduces a significant attack surface for supply chain risks or vulnerabilities in content parsing. Additionally, the agent is instructed to read local files (`templates.md`) and write reports to the local filesystem (`reports/`), demonstrating file system interaction capabilities. While the prompt injection instruction for keyword expansion is for a functional purpose, the combination of network access to arbitrary external content and file system interactions, without the full script for review, elevates the risk profile beyond benign.