← 返回 Skills 市场

GitHub Trending Monitor

Name: GitHub Trending Monitor
Author: zhdryanchang

作者 zhdryanchang · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

408

总下载

当前安装

版本数

在 OpenClaw 中安装

/install github-trending-monitor

功能描述

Monitor GitHub trending repositories by language and time range, receiving daily alerts via Telegram, Discord, or Email with pay-per-use pricing.

使用说明 (SKILL.md)

GitHub Trending Monitor

Monitor GitHub trending repositories and receive daily notifications.

Features

🔥 Real-time monitoring of GitHub trending repositories
🌍 Filter by programming language (JavaScript, Python, Go, Rust, etc.)
📅 Time ranges: Daily, weekly, or monthly trends
📱 Multi-channel notifications: Telegram, Discord, Email
⏰ Scheduled daily reports
💰 Pay-per-use: 0.001 USDT per call

API Endpoints

GET /trending

Fetch current GitHub trending repositories.

Query Parameters:

language (optional): Programming language filter
since (optional): Time range - daily, weekly, monthly

Example:

curl "http://localhost:3000/trending?language=javascript&since=daily"

Response:

{
  "success": true,
  "data": [
    {
      "name": "awesome-project",
      "author": "github-user",
      "description": "An awesome project",
      "language": "JavaScript",
      "stars": 1234,
      "forks": 567,
      "todayStars": 89,
      "url": "https://github.com/github-user/awesome-project"
    }
  ]
}

POST /notify

Trigger immediate notification with trending repositories.

Request:

{
  "userId": "user123",
  "transactionId": "tx456",
  "channels": {
    "telegram": { "chatId": "123456789" }
  },
  "language": "javascript",
  "since": "daily"
}

POST /subscribe

Subscribe to daily trending notifications.

Request:

{
  "userId": "user123",
  "channels": {
    "telegram": { "chatId": "123456789" }
  },
  "preferences": {
    "language": "javascript",
    "since": "daily"
  }
}

Configuration

Required environment variables:

SKILLPAY_API_KEY: SkillPay API key (required)
TELEGRAM_BOT_TOKEN: Telegram bot token (optional)
DISCORD_WEBHOOK_URL: Discord webhook URL (optional)
EMAIL_USER/EMAIL_PASS: SMTP credentials (optional)

Installation

npm install
npm start

Pricing

0.001 USDT per API call
Automatic settlement via SkillPay.me

License

MIT

安全使用建议

This skill mostly does what it claims, but proceed cautiously. Key points to consider before installing or running it: (1) The package contains a hardcoded SkillPay API key in skill.json and README — treat that as a leaked secret. Do not use that key: remove it from the files and replace it with your own environment variable, and rotate the key if it is real. (2) The registry metadata omits required env vars while SKILL.md and the code require SKILLPAY_API_KEY (and optional TELEGRAM/DISCORD/EMAIL creds) — ensure you set only the credentials you control. (3) The skill contacts api.skillpay.me and will send usage/payment data there — verify the SkillPay provider and account. (4) Inspect and run the code in an isolated environment (local machine or sandbox) and avoid setting production credentials until you are satisfied. (5) If you plan to publish or use this skill publicly, remove any embedded secrets and update the manifest to accurately declare required environment variables. If you are uncertain whether the hardcoded key is valid, assume it is and rotate the credential in any linked SkillPay account.

功能分析

Type: OpenClaw Skill Name: github-trending-monitor Version: 1.0.0 The bundle provides a GitHub trending monitor with Telegram, Discord, and Email notifications. It is classified as suspicious due to security vulnerabilities, specifically a hardcoded SkillPay API key in `skill.json` and documentation, and an overly permissive CORS policy (Access-Control-Allow-Origin: *) in `src/index.js`. While the code's behavior (scraping, network requests, and environment variable access) aligns with its stated purpose, the inclusion of hardcoded credentials and broad network capabilities warrants caution.

能力评估

ℹ Purpose & Capability

The code and documentation implement the advertised functionality (scraping GitHub trending pages, multi-channel notifications, scheduled reports, and pay-per-use via SkillPay). However the registry metadata claims no required environment variables while SKILL.md and the code clearly expect SKILLPAY_API_KEY (and optional TELEGRAM/ DISCORD/EMAIL creds). Additionally, skill.json contains an embedded 'apiKey' value — this is inconsistent with normal practice (API keys should be provided via environment) and is unnecessary for the skill's stated purpose.

✓ Instruction Scope

Runtime instructions in SKILL.md and the source code are scoped to fetching trending repos, sending notifications, handling subscriptions, and talking to SkillPay. I found no instructions to read unrelated local files, read system-level credentials, or exfiltrate arbitrary files. The skill sends payment and usage data to api.skillpay.me (expected for pay-per-use).

✓ Install Mechanism

No remote installers or URL downloads are used; dependencies are standard npm packages listed in package.json. There is no install spec in the registry (instruction-only), and running the project installs usual npm modules — low-to-moderate install risk.

⚠ Credentials

The environment variables the code uses (SKILLPAY_API_KEY, TELEGRAM_BOT_TOKEN, DISCORD_WEBHOOK_URL, EMAIL_* , optional GITHUB_TOKEN) are appropriate for the feature set. However a SkillPay API key is hardcoded in skill.json and is also present in the README's .env example — that is a sensitive secret baked into the package and not justified by the skill's functionality. Also the registry metadata listing no required env vars conflicts with the actual requirements, which is misleading.

✓ Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide configurations. It runs an Express server, a scheduler, and optionally a Telegram bot, which are reasonable for its stated purpose. Autonomous invocation is enabled by default (normal for skills) but is not combined with other high-risk flags here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install github-trending-monitor
安装完成后，直接呼叫该 Skill 的名称或使用 /github-trending-monitor 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: Monitor GitHub trending repositories with multi-channel notifications (Telegram, Discord, Email). Features include language filtering, time range selection, scheduled daily reports, and SkillPay integration.

元数据

Slug github-trending-monitor

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题