← 返回 Skills 市场

Agent2RSS - AI Content to RSS Feed

Name: Agent2RSS - AI Content to RSS Feed
Author: yaotutu

作者 Yao Tutu · GitHub ↗ · v0.2.1

cross-platform ⚠ suspicious

784

总下载

当前安装

版本数

在 OpenClaw 中安装

/install agent2rss

功能描述

Agent2RSS 客户端，管理 RSS 频道并推送内容。触发：用户提到 Agent2RSS/RSS 频道/推送文章/上传文章/创建频道/设置默认频道/幂等性。

使用说明 (SKILL.md)

Agent2RSS Client（OpenClaw）

管理 Agent2RSS 频道并推送内容到 RSS。

Requirements

bash
curl
jq

重要安全说明

本技能会向 config.json 中的 serverUrl 发起网络请求（创建频道、上传内容、推送文章）。
默认 serverUrl 是 https://agent2rss.yaotutu.top:8765（官方托管服务）。
如果改为远程地址，请只使用你信任的服务；远程 http:// 会有明文传输风险。
频道 token 存储在：
- $HOME/.openclaw/workspace/.skill-data/agent2rss-client/config.json
脚本会将该文件权限收敛为 600。不要把该文件提交到仓库。

路径约定

脚本：scripts/agent2rss.sh
配置目录：$HOME/.openclaw/workspace/.skill-data/agent2rss-client/
配置文件：$CONFIG_DIR/config.json
模板：assets/config-template.json

初始化（默认官方服务，不会自动建频道）

# 推荐：直接使用官方托管服务（默认）
scripts/agent2rss.sh init

# 如果你有自建实例，再显式指定 server-url
scripts/agent2rss.sh init --server-url https://your-agent2rss.example.com

init 只初始化配置，不会自动创建默认频道。请显式执行 create-channel。 Agent2RSS 是开源项目，可自部署：https://github.com/yaotutu/agent2rss。

常用命令

# 健康检查
scripts/agent2rss.sh health

# 创建频道（并设为默认）
scripts/agent2rss.sh create-channel "技术博客" "分享技术文章"

# 列出频道
scripts/agent2rss.sh list

# 设置默认频道
scripts/agent2rss.sh set-default \x3CchannelId>

# 上传文件推送（推荐）
scripts/agent2rss.sh push-file article.md

# JSON 推送
scripts/agent2rss.sh push-json post.json

# 仅预览请求，不实际发送
DRY_RUN=1 scripts/agent2rss.sh push-file article.md

网络操作范围（透明说明）

脚本会调用以下接口（基于 serverUrl）：

GET /health
POST /api/channels
PUT /api/channels/:id
POST /api/channels/:id/posts
POST /api/channels/:id/posts/upload

幂等建议

idempotencyKey 建议使用：文章URL、文件名+哈希 或业务唯一 ID。
重复推送同一 key 时应返回已存在（isNew: false）。

常见错误

401：token 无效或缺失。
404：频道 ID 不存在。
400：缺少 content/file 等必填字段。
5xx：服务异常，稍后重试。

参考

API 示例：references/api-examples.md
发布前回归清单：references/e2e-test.md

安全使用建议

This skill appears to do what it says: it manages RSS channels and pushes content to a configured Agent2RSS server. Before installing or using it, consider: (1) The default server is a remote host (https://agent2rss.yaotutu.top:8765). Only use that host if you trust it — you can set SERVER_URL to a self-hosted instance. (2) Channel tokens (secrets) are stored in ~/.openclaw/workspace/.skill-data/agent2rss-client/config.json and are sent to the configured server as Authorization headers; ensure that file is not committed to version control and has appropriate permissions. (3) If you have sensitive content, self-host the server or review the server's privacy/security before sending posts. (4) You can review and run the provided scripts locally to confirm behavior; rotate tokens if you suspect exposure.

功能分析

Type: OpenClaw Skill Name: agent2rss Version: 0.2.1 The `scripts/agent2rss.sh` file contains a shell injection vulnerability in the `create_channel` and `update_channel` functions. The `name` and `description` arguments are directly interpolated into a `curl -d` JSON string without proper escaping, allowing an attacker to inject arbitrary `curl` arguments or shell commands if they can control these inputs. This could lead to Remote Code Execution (RCE) on the agent's host. While the `SKILL.md` is transparent and does not contain prompt injection attempts, this critical vulnerability makes the skill suspicious.

能力评估

✓ Purpose & Capability

Name/description match the included script and docs. Required tools (bash, curl, jq) and operations (create channels, upload posts, health checks) are appropriate for an RSS push client. No unrelated credentials or binaries are requested.

ℹ Instruction Scope

SKILL.md and the script clearly limit runtime actions to reading/writing a config file in the skill-data directory and making HTTP(S) calls to the configured serverUrl (default https://agent2rss.yaotutu.top:8765). The instructions do not attempt to read other user files or system credentials. Note: the script will read/write $HOME/.openclaw/workspace/.skill-data/agent2rss-client/config.json where channel tokens are stored.

✓ Install Mechanism

No install spec — instruction-only plus a helper shell script. Nothing is downloaded or installed at runtime by the skill itself, minimizing install-time risk.

ℹ Credentials

The skill declares no required env vars but supports optional CONFIG_DIR/CONFIG_FILE/SERVER_URL/DRY_RUN. Channel tokens are persisted in the skill's config.json and used as 'Authorization: Bearer <token>' when calling the configured server. Storing tokens locally and sending them to the default remote service is expected for this function but is sensitive — the skill attempts to set file permissions to 600, but you should verify file safety and only use trusted servers.

✓ Persistence & Privilege

always is false and the skill does not request system-wide privileges. The script writes only to its own skill-data config path and does not modify other skills or global agent settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install agent2rss
安装完成后，直接呼叫该 Skill 的名称或使用 /agent2rss 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.2.1

**Changelog for agent2rss 0.2.1** - Added three new files: `.clawhub/origin.json`, `_meta.json`, `references/.DS_Store`. - Clarified security instructions in documentation: explicit warnings about serverUrl trust and token file location. - Changed default behavior: `init` no longer auto-creates a default channel; users must explicitly create channels. - Updated documentation for clearer usage, safety recommendations, and path conventions. - Separated network access details and common error handling for better transparency. - Revised trigger word list in the description (now omits “上传文章/幂等性” and reorders triggers).

v0.2.0

agent2rss-client v0.2.0 - 新增一键 Bash 脚本 scripts/agent2rss.sh，实现初始化、频道管理、文章推送等完整命令行工具 - 支持自动初始化配置和频道，无配置时自动创建默认频道 - 提供文件上传和 JSON 两种推送方式，推荐上传文件避免转义问题 - 实现频道的创建、更新、切换默认、列出和删除等常用管理命令 - 完善本地配置/缓存路径规范及 API 错误处理提示 - 依赖自动检查，jq/python 均可，便于多平台通用

v0.1.0

## v1.0.0 - Initial Release ### Features - Multi-channel RSS feed management - AI-friendly JSON and file upload API - 6 beautiful built-in themes (GitHub, Minimal, Dark, Modern, Elegant, Clean) - Rich Markdown support with 10+ extensions - Idempotency support to prevent duplicate posts - Auto title extraction from Markdown - Token-based authentication - High-performance Bun runtime - SQLite database with automatic migrations - Swagger API documentation - Tag support for posts - Rolling storage with configurable max posts ### Use Cases - AI agent blog publishing - News aggregation - Content curation - Automated reports - Multi-tenant RSS service

元数据

Slug agent2rss

版本 0.2.1

许可证 —

累计安装 1

当前安装数 1

历史版本数 3

常见问题