抓取指定即刻 Topic 最近 50 条内容，筛选最近 24 小时内有价值的 post，生成摘要、可实践建议、灵感启发，输出为每日精选 Markdown 文档。 当用户说"帮我总结即刻 topic"、"即刻日报"、"jike digest"、"jike 摘要"、"即刻每日精选"、"抓取即刻 {topic_id}"...

This skill appears coherent with its stated function, but take these practical precautions before installing or running it: (1) Verify and set BASE_DIR to a safe location you control — the default points to a specific user's Desktop path and could overwrite files. (2) Confirm what 'autocli jike' requires on your system (it may rely on your Jike account/configured credentials); ensure you trust autocli and understand where it stores auth. (3) Back up any files under the target output directory before running, since the instructions indicate existing files may be cleared. (4) Review and run scripts/filter_recent.py locally to confirm behaviour; it only parses JSON, filters by timestamp, and writes JSON/STDOUT. (5) If you will let an agent invoke the skill autonomously, be comfortable that the agent may run autocli (which performs network requests using whatever credentials are present). If any of these items are unacceptable, do not install or run the skill until you adjust configuration or inspect dependencies.

Type: OpenClaw Skill Name: jike-digest Version: 1.0.1 The skill contains a potential shell injection vulnerability in SKILL.md, as the `{topic_id}` parameter is passed directly into a shell command (`autocli`) without explicit sanitization instructions. Additionally, it uses a hardcoded absolute path (`/Users/victor/Desktop/...`) as a default directory, which is highly specific to a local environment and potentially risky if the agent attempts to manage files (e.g., the 'clearing' step) in unintended locations. The Python script `scripts/filter_recent.py` itself appears benign and performs standard data filtering.