News Aggregator Skill

Comprehensive news aggregator that fetches, filters, and deeply analyzes real-time content from 8 major sources: Hacker News, GitHub Trending, Product Hunt, 36Kr, Tencent News, WallStreetCN, V2EX, and Weibo. Best for 'daily scans', 'tech news briefings', 'finance updates', and 'deep interpretations' of hot topics.

What to consider before installing: - Inspect the SKILL.md and scripts/fetch_news.py yourself (or have a trusted reviewer) — the skill contains executable Python code that makes network requests and writes reports to disk. The code is plausible for a news aggregator, but you should verify there are no hidden backdoors or obfuscated behaviors (the pre-scan found unicode control characters in SKILL.md). - Be cautious with 'deep' mode: it fetches the full text of article URLs discovered in feeds. That allows requests to arbitrary URLs (SSRF risk). If you plan to use this skill, either disable automatic deep fetching by default or restrict it to an explicit user-approved mode. - Run the skill in a sandbox or environment with restricted network access (no access to internal IP ranges) until you are confident. Limit concurrency/timeouts and consider a URL whitelist for deep fetching. - Because the source/homepage is unknown, prefer obtaining the skill from a verifiable source (official repo or maintainer). If you must install, avoid giving it credentials and avoid running it on hosts that contain sensitive internal services. - Remove or examine any invisible/unicode control characters in SKILL.md (these may be prompt-injection attempts). Also verify that templates.md and other files do not contain unexpected instructions or hard-coded endpoints. - If you want to proceed: require explicit user confirmation before any global-scan/deep actions, and consider modifying fetch_news.py to limit which domains can be fetched and to log fetching actions for auditing.

Type: OpenClaw Skill Name: news-aggregator-skill-3 Version: 0.1.0 The skill is classified as suspicious due to its inherent high-risk capabilities, despite being aligned with its stated purpose. The `scripts/fetch_news.py` file performs extensive network requests to external URLs for news aggregation and deep content fetching, which is a significant attack surface if the URLs were to be manipulated. Additionally, the `SKILL.md` file instructs the AI agent to automatically expand user keywords (a form of prompt manipulation) and to save generated reports to the local filesystem (`reports/` directory), which are file write operations. While these actions are functional for a news aggregator, they represent capabilities that could be abused without clear malicious intent in the provided code.