← Back to Skills Marketplace
1154
Downloads
1
Stars
4
Active Installs
1
Versions
Install in OpenClaw
/install clawfeed-2
Description
AI-powered tool generating structured news summaries from Twitter and RSS feeds with digest options for 4H, daily, weekly, and monthly intervals.
README (SKILL.md)
ClawFeed
AI-powered news digest tool. Automatically generates structured summaries (4H/daily/weekly/monthly) from Twitter and RSS feeds.
Credentials & Dependencies
ClawFeed runs in read-only mode with zero credentials — browse digests, view feeds, switch languages. Authentication features (bookmarks, sources, packs) require additional credentials.
| Credential | Purpose | Required |
|---|---|---|
GOOGLE_CLIENT_ID |
Google OAuth login | For auth features |
GOOGLE_CLIENT_SECRET |
Google OAuth login | For auth features |
SESSION_SECRET |
Session cookie encryption | For auth features |
API_KEY |
Digest creation endpoint protection | For write API |
Runtime dependency: SQLite via better-sqlite3 (native addon, bundled). No external database server required.
Setup
# Install dependencies
npm install
# Copy environment config
cp .env.example .env
# Edit .env with your settings
# Start API server
npm start
Environment Variables
Configure in .env file:
| Variable | Description | Required | Default |
|---|---|---|---|
DIGEST_PORT |
Server port | No | 8767 |
GOOGLE_CLIENT_ID |
Google OAuth client ID | For auth | - |
GOOGLE_CLIENT_SECRET |
Google OAuth client secret | For auth | - |
SESSION_SECRET |
Session cookie encryption key | For auth | - |
API_KEY |
Digest creation API key | For write API | - |
AI_DIGEST_DB |
SQLite database path | No | data/digest.db |
ALLOWED_ORIGINS |
CORS allowed origins | No | localhost |
API Server
Runs on port 8767 by default. Set DIGEST_PORT env to change.
Endpoints
| Method | Path | Description | Auth |
|---|---|---|---|
| GET | /api/digests | List digests (?type=4h|daily|weekly&limit=20&offset=0) | - |
| GET | /api/digests/:id | Get single digest | - |
| POST | /api/digests | Create digest (internal) | - |
| GET | /api/auth/google | Start Google OAuth flow | - |
| GET | /api/auth/callback | OAuth callback endpoint | - |
| GET | /api/auth/me | Get current user info | Yes |
| POST | /api/auth/logout | Logout user | Yes |
| GET | /api/marks | List user bookmarks | Yes |
| POST | /api/marks | Add bookmark | Yes |
| DELETE | /api/marks/:id | Remove bookmark | Yes |
| GET | /api/config | Get configuration | - |
| PUT | /api/config | Update configuration | - |
Web Dashboard
Serve web/index.html via your reverse proxy or any static file server.
Templates
templates/curation-rules.md— Customize feed curation rulestemplates/digest-prompt.md— Customize the AI summarization prompt
Configuration
Copy config.example.json to config.json and edit. See README for details.
Reverse Proxy (Caddy example)
handle /digest/api/* {
uri strip_prefix /digest/api
reverse_proxy localhost:8767
}
handle_path /digest/* {
root * /path/to/clawfeed/web
file_server
}
Usage Guidance
This is an instruction-only Node.js project and not a packaged binary — before installing or running it: (1) inspect the project's package.json and package-lock (or yarn.lock) to see exact dependency names and versions; (2) verify how Twitter feeds are obtained (look for twitter API client usage or scraping code) — if you rely on Twitter API you should expect additional credentials; (3) run npm install and the service inside an isolated environment (container or VM) because npm packages (especially native addons like better-sqlite3) run code during install; (4) if you enable auth/write features, set a strong SESSION_SECRET and API_KEY and restrict ALLOWED_ORIGINS; (5) review templates and curation rules to ensure no accidental data exfiltration; and (6) avoid running this on sensitive hosts until you’ve audited dependencies and the source code. If you can obtain the full repository (package.json + code) and a list of dependency versions, re-run this evaluation — that would raise confidence.
Capability Analysis
Type: OpenClaw Skill
Name: clawfeed-2
Version: 0.1.0
The `SKILL.md` file describes a news digest tool that instructs the OpenClaw agent to execute `npm install`, which carries an inherent supply chain risk as the `package.json` is not provided. The skill also exposes a `PUT /api/config` endpoint, allowing configuration updates which could be abused if not properly secured. Additionally, the skill explicitly mentions `templates/digest-prompt.md` for customizing the AI summarization prompt, indicating a potential prompt injection vulnerability against the skill's internal AI if the OpenClaw agent is instructed to modify this file based on untrusted input. These elements represent risky capabilities and vulnerabilities rather than clear malicious intent.
Capability Assessment
Purpose & Capability
The name/description (Twitter + RSS digest) align with the files and endpoints described in SKILL.md (digest endpoints, templates, curation rules). However SKILL.md does not document how Twitter feeds are ingested (no Twitter API keys, no scraping approach described), which is an unexplained gap for the advertised capability.
Instruction Scope
Runtime instructions are limited to standard Node project steps (npm install, copy .env, npm start) and references to local config/templates and an SQLite DB path. The instructions do not ask the agent to access unrelated system files or credentials beyond the project, but they do require editing .env and config files inside the project.
Install Mechanism
This is an instruction-only skill that tells you to run `npm install` — which will fetch and run arbitrary packages from the npm registry. The README specifically lists a native addon dependency (better-sqlite3), which may compile native code during install. Because there is no packaged code in the skill bundle and no explicit package.json to inspect here, running install pulls unreviewed third-party code and native build steps — a moderate risk.
Credentials
The registry lists no required env vars or credentials, while SKILL.md documents optional env vars (GOOGLE_CLIENT_ID/SECRET, SESSION_SECRET, API_KEY) for auth/write features. Those variables are plausible and proportional. The only minor inconsistency: the description claims 'zero credentials' for read-only mode but the doc then lists several optional secrets for extended features — this is reasonable but should be noted.
Persistence & Privilege
The skill does not request always:true or system-wide privileges. It runs a local API server and writes a local SQLite DB (`data/digest.db`) — expected for this app. It does not declare modifications to other skills or global agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install clawfeed-2 - After installation, invoke the skill by name or use
/clawfeed-2 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
- Initial release of ClawFeed, an AI-powered news digest tool for Twitter and RSS feeds
- Supports automatic structured summaries (4H/daily/weekly/monthly)
- Read-only mode available without credentials (browse digests, switch languages)
- Optional Google OAuth authentication for bookmarks and feed management
- Simple API with endpoints for digests, authentication, bookmarks, and configuration
- No external database required—uses bundled SQLite
- Dashboard included; serve web UI via static file server or reverse proxy
Metadata
Frequently Asked Questions
What is Clawfeed?
AI-powered tool generating structured news summaries from Twitter and RSS feeds with digest options for 4H, daily, weekly, and monthly intervals. It is an AI Agent Skill for Claude Code / OpenClaw, with 1154 downloads so far.
How do I install Clawfeed?
Run "/install clawfeed-2" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Clawfeed free?
Yes, Clawfeed is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Clawfeed support?
Clawfeed is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Clawfeed?
It is built and maintained by 94W666 (@94w666); the current version is v0.1.0.
More Skills