Tageblatt Headlines

Download and archive daily Schlagzeilen from https://www.tageblatt.de/. Use when Master asks for TAGEBLATT headlines, wants them saved locally, or needs an automated 07:00 workflow that fetches and forwards the latest headlines.

This skill appears to do exactly what it claims: fetch and save Tageblatt headlines. Before installing, consider: (1) Confirm you have permission to scrape the site and check robots.txt/terms of service. (2) If you plan automated delivery (Telegram), ensure you configure tokens securely elsewhere — the skill does not include or request Telegram credentials. (3) The parser is a simple regex and may break if the site structure or consent banners change; review HEADING_PATTERN if you see missing headlines. (4) The script writes files under paths you supply (e.g., data/tageblatt/) — review retention and commit practices to avoid storing sensitive data. (5) Run the script locally once to verify behavior and outputs before enabling automation.

Type: OpenClaw Skill Name: tageblatt-headlines Version: 1.0.0 The skill bundle is classified as suspicious due to significant vulnerabilities in `scripts/fetch_headlines.py` and the prompt injection surface in `SKILL.md`. The Python script allows fetching content from arbitrary URLs via the `--url` argument (Server-Side Request Forgery) and writing to arbitrary file paths via the `--output` argument (Arbitrary File Write). While the current instructions in `SKILL.md` are benign and align with the stated purpose of archiving headlines and forwarding them via Telegram, these capabilities, combined with the agent's ability to execute commands and follow instructions, create a high-risk attack surface for potential exploitation.