News Digest Aggregator - 新闻聚合

Daily automated news digest that fetches RSS feeds, aggregates articles using LLM summarization, and delivers formatted digests to messaging channels (Discor...

Key things to check before installing/running: - Understand the real capabilities: the package claims to do LLM summarization but the script does not call any LLM service. If you expect LLM summaries, ask the author for the intended integration or add your own LLM calls (and the corresponding API key handling). - The registry metadata doesn't declare required env vars; the script requires DISCORD_WEBHOOK_URL, SLACK_WEBHOOK_URL, or FEISHU_WEBHOOK_URL at runtime. Set these only to trusted webhook endpoints. - The script auto-installs dependencies via pip at runtime (unpinned). Prefer to run pip install yourself in a controlled environment with pinned versions, or request a requirements.txt / explicit install instructions from the author. - Audit sources.json to ensure you trust the RSS feeds being fetched and that the fetch timeout and article limits meet your expectations. - If you will run this on a server or schedule it (cron), run it in an isolated environment (container or virtualenv), pin dependencies, and consider adding logging/monitoring. If you need LLM summarization, require and manage LLM API keys explicitly rather than relying on undocumented behavior. If you want, I can produce a safer requirements.txt, add explicit LLM integration scaffolding, or create a hardened run checklist for deployment.

Type: OpenClaw Skill Name: news-digest-aggregator Version: 1.0.0 The news-digest-aggregator skill is a standard utility for fetching RSS feeds and sending summaries to Discord, Slack, or Feishu. The code in `scripts/fetch_and_digest.py` uses `os.system` to automatically install missing dependencies (`feedparser` and `requests`), which is a common practice for standalone scripts, though it bypasses traditional package management. The script correctly handles sensitive webhook URLs via environment variables and does not exhibit any signs of data exfiltration, persistence, or malicious intent. While the `SKILL.md` mentions LLM summarization which is not explicitly implemented in the Python code (it uses simple truncation), this appears to be a minor documentation discrepancy rather than a malicious deception.