News Brief Skill

根据用户设定的兴趣方向，每天定时获取对应领域的新闻内容，生成摘要简报并推送至用户指定渠道，支持用户反馈与Skill优化。

This skill appears to implement the advertised news-aggregation and push features, but check these before installing: - Understand where credentials will be stored: the skill saves per-user configs (email, webhook tokens, etc.) under data/users and backs them up. If those directories are on a shared host, others may access them. - Encryption is implemented, but the encryption key is generated and saved to config/encryption.key by default. That means anyone with filesystem access to the skill folder can decrypt stored secrets. Prefer supplying an encryption key from a secure secret store or environment variable and confirm the key file is not committed or exposed. - The documentation claims it does not store user identity, but the code stores user IDs and per-user directories. If that conflicts with your privacy requirements, do not install as-is. - Review and restrict filesystem permissions for the skill directory (config/ and data/), and consider running it in an isolated environment. - There are some code-quality issues (e.g., a missing import and other truncated blocks in the provided sources) — you should test in a safe environment before enabling automatic daily runs. If you want to proceed: (1) provide credentials only when necessary, (2) replace the on-disk encryption key with a key from a secure secret manager or environment variable, (3) restrict access to the skill directory, and (4) audit any additional omitted files not included here.

Type: OpenClaw Skill Name: news-brief-skill Version: 1.0.0 The news-brief-skill is a well-structured news aggregation and notification tool designed to fetch, summarize, and push news updates to users. It implements legitimate features for multi-source news gathering (RSS, API, and BeautifulSoup-based web scraping) and supports multiple notification channels including Email, DingTalk, and Telegram. Notably, the skill demonstrates good security practices in `scripts/config_manager.py` by using AES-256 encryption (via the cryptography library) to protect sensitive user credentials such as SMTP passwords and API tokens. No evidence of malicious intent, unauthorized data exfiltration, or dangerous command execution was found across the codebase.