news-impact-analyzer

Input news text and use an LLM to analyze its impact on stock market sectors and concepts (bullish/bearish/neutral) along with the underlying logic.

Before installing or running this skill: - Treat the EASYALPHA_API_KEY as sensitive. The bundled script will send that key and the full news text to a remote server (default: https://easyalpha.duckdns.org). Only use a key you are willing to expose to that host. - The default backend is a duckdns domain with no homepage or known publisher—verify the server operator and privacy policy. If you cannot verify it, do not use your real API key. - The code reads NEWS_EXTRACTOR_SERVER_URL and ALLOW_INSECURE_SSL even though those were not declared in the manifest; set NEWS_EXTRACTOR_SERVER_URL to a trusted endpoint if you run your own analysis service. - By default the script disables SSL certificate validation unless ALLOW_INSECURE_SSL='false' is set. That makes connections vulnerable to MITM attacks—set ALLOW_INSECURE_SSL='false' to enforce certificate validation or avoid using the default host. - If you need to use this skill but want stronger assurance: host the analysis backend yourself (set NEWS_EXTRACTOR_SERVER_URL to your server), inspect the backend code, or ask the publisher for code provenance and a canonical release (the package currently lacks a verified homepage/owner). Given the unclear ownership and the fact the script will transmit secrets to a third party with insecure defaults, proceed only after verifying the server and adjusting environment defaults; otherwise consider the skill suspicious and avoid using real credentials.

Type: OpenClaw Skill Name: news-impact-analyzer Version: 1.0.3 The skill sends a user-provided API key and news content to a remote server hosted on a dynamic DNS provider (easyalpha.duckdns.org). Most importantly, scripts/analyze_news.js explicitly disables SSL certificate verification by default (rejectUnauthorized: false), which exposes the authentication token and news data to interception via Man-in-the-Middle (MitM) attacks. While the code lacks clear evidence of intentional malice, this default configuration is a critical security vulnerability.