News Briefing

Real-time AI news briefing for any topic. Say "给我看大谷翔平的新闻" or "AI今天有什么大新闻", and your agent instantly searches the web, summarizes the top stories in Chinese,...

This skill appears to do what it claims: search Perplexity, optionally call PPIO for insights, and post formatted cards to Feishu. Before installing or running it, consider: 1) You must provide FEISHU and PERPLEXITY (and optionally PPIO) API keys — grant least privilege and avoid using high-priv production credentials until you trust it. 2) The scripts use execSync and shell-constructed curl commands, which can be brittle and risk command injection if untrusted input is fed into the CLI; prefer running with controlled topic strings or sanitizing inputs. 3) gen-cover uses hard-coded system paths (pnpm global path, /root workspace, system fonts) and may fail or behave unexpectedly; run cover generation in a sandbox or skip it if you don't need images. 4) Test in a safe environment and verify Feishu messages go only to intended recipients (use dry-run and TARGET_USER_ID) before enabling scheduled runs with real credentials.

Type: OpenClaw Skill Name: news-briefing Version: 2.0.0 The skill bundle provides legitimate news briefing functionality but contains significant security vulnerabilities. Multiple scripts (fetch-news.mjs, news-digest.mjs) use 'child_process.execSync' to construct shell commands via string concatenation with user-supplied inputs (like 'topic'), creating a high risk of shell injection. While the behavior aligns with the stated purpose of fetching news via Perplexity and sending Feishu cards, the lack of input sanitization and the use of hardcoded system paths in 'gen-cover.mjs' are risky practices.