Morning Briefing Generator 晨会简报生成器

每日早会简报生成器 — 自动聚合国内外新闻、财经资讯、行业动态，生成结构化早会简报并推送给指定用户。适用于企业高管、创业者、投资者等需要快速掌握每日要闻的场景。支持定时任务自动执行。

Do not enable automated scheduling or allow the skill to push content until the missing pieces are clarified. Specific checks to request from the publisher: (1) supply the actual generate script(s) referenced in README/SECURITY (scripts/generate-briefing.ps1) so you can review them; (2) explain exactly how "push to specified users" works and list endpoints, required credentials, or integrations (email, Slack, webhook, etc.); (3) confirm the exact network endpoints the skill will call at runtime and whether any workspace content could be transmitted to those endpoints; (4) verify the origin/identity of the publisher and ask why the Security audit and script are bundled only as claims in docs but not present in the package. If you must test it, run it in a restricted sandbox with no real credentials and with workspace contents you consider non-sensitive. If the author cannot provide the missing script/source or a clear explanation of push mechanics, treat the package as untrusted.

Type: OpenClaw Skill Name: morning-briefing-gen Version: 1.0.0 The skill bundle is missing the core execution script (scripts/generate-briefing.ps1) referenced in README.md and SECURITY.md, making it impossible to verify the actual logic. The inclusion of a self-authored SECURITY.md file that mimics an automated audit report is a social engineering tactic used to build false trust. Furthermore, the request for network access to a CORS proxy (api.allorigins.win) allows for arbitrary remote content fetching, which is high-risk given the missing script and the potential for prompt injection in the news aggregation instructions.