← 返回 Skills 市场
2855
总下载
3
收藏
38
当前安装
1
版本数
在 OpenClaw 中安装
/install ai-daily-digest
功能描述
Fetches RSS feeds from 90 top Hacker News blogs (curated by Karpathy), uses AI to score and filter articles, and generates a daily digest in Markdown with Ch...
安全使用建议
Install only if you are comfortable providing an AI API key, sending RSS article titles/descriptions/URLs to Gemini or your configured OpenAI-compatible provider, and having the Gemini key saved locally in `~/.hn-daily-digest/config.json`. Prefer a restricted or low-billing-limit key, avoid using this on shared machines, delete the config file when done, and do not set `OPENAI_API_BASE` to an endpoint you do not trust.
功能分析
Type: OpenClaw Skill
Name: ai-daily-digest
Version: 1.0.0
The skill bundle is classified as suspicious due to several critical vulnerabilities, primarily shell injection and prompt injection against the LLM. In `SKILL.md`, the agent is instructed to export user-provided API keys (`GEMINI_API_KEY`, `OPENAI_API_KEY`) directly into shell commands without proper sanitization, creating a direct Remote Code Execution (RCE) risk. Additionally, the `scripts/digest.ts` code embeds untrusted article titles and descriptions from RSS feeds directly into prompts for the AI model, making the LLM vulnerable to prompt injection attacks. A path traversal vulnerability also exists in `scripts/digest.ts` if a user-controlled `--output` path is not properly sanitized, allowing arbitrary file writes.
能力评估
Purpose & Capability
The artifacts coherently implement an AI RSS digest: they fetch a fixed list of public RSS feeds, score and summarize articles with Gemini or an OpenAI-compatible provider, and write a Markdown report.
Instruction Scope
The /digest workflow is user-invoked and asks for parameters, but it also directs the agent to save and later reuse configuration including an API key.
Install Mechanism
There is no hidden installer, but execution uses `npx -y bun`, which can download and run the Bun runtime at use time; this is disclosed in the skill instructions.
Credentials
Network access to RSS feeds and AI APIs is proportional to the digest purpose. The custom `OPENAI_API_BASE` option is disclosed and useful for compatible providers, but users should only set it to a provider they trust.
Persistence & Privilege
The skill explicitly writes `geminiApiKey` to `~/.hn-daily-digest/config.json` as plaintext and reuses it later. That credential persistence is disclosed, but it lacks clear opt-in security warning, permission hardening, or use of a secure secret store.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install ai-daily-digest - 安装完成后，直接呼叫该 Skill 的名称或使用
/ai-daily-digest触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release: RSS feeds from 90 top HN blogs, AI-scored daily digest with Chinese translation and visual stats
元数据
常见问题
AI Daily Digest 是什么？
Fetches RSS feeds from 90 top Hacker News blogs (curated by Karpathy), uses AI to score and filter articles, and generates a daily digest in Markdown with Ch... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 2855 次。
如何安装 AI Daily Digest？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install ai-daily-digest」即可一键安装，无需额外配置。
AI Daily Digest 是免费的吗？
是的，AI Daily Digest 完全免费（开源免费），可自由下载、安装和使用。
AI Daily Digest 支持哪些平台？
AI Daily Digest 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 AI Daily Digest？
由 royxiao08（@royxiao08）开发并维护，当前版本 v1.0.0。
推荐 Skills