News Evening Digest - 新闻晚报

每天晚上 8 点自动推送全球新闻晚报到 QQ 和飞书，参考 World Monitor 数据源

Do not install blindly. Actionable checks before use: - Inspect the full fetch_and_digest.py (the provided file is truncated) and confirm where and how it sends data (Feishu webhook URL, any other endpoints). Ensure no hidden/external endpoints beyond explained APIs. - Fix env var mismatches: SKILL.md mentions FEISHU_WEBHOOK_URL and WORLD_MONITOR_API but the script requires TAVILYAPIKEY and optionally MULTI_SOURCE_ENABLED. Make environment requirements explicit in the registry and SKILL.md. - Verify and test locally in a sandbox/VM: run the script manually, confirm it only performs expected HTTP requests to documented services (Tavily, World Monitor, Feishu), and inspect request payloads. - Audit dependencies: identify whether this skill expects a separate 'Multi-Source-Research' skill — if so, review that skill too before connecting them. - Protect secrets: do not store webhook/API keys in shared plaintext files without appropriate file permissions; consider using a secrets manager or platform-provided secure env storage. - Limit blast radius: if adding the cron job, start with a test schedule and a test Feishu/QQ bot (not a production channel) to verify content and avoid accidental posting of sensitive material. - If you are not comfortable auditing the script, treat this as untrusted code and avoid granting it network/cron access. Fix the code issues (undefined function calls, inconsistent env names) before relying on it.

Type: OpenClaw Skill Name: news-evening-digest Version: 1.0.0 The skill is a news aggregation tool designed to fetch global news via the Tavily API and send daily digests to Feishu or WeCom webhooks. Analysis of `scripts/fetch_and_digest.py` and the documentation reveals no malicious behavior, data exfiltration, or unauthorized execution. While there are minor functional bugs—such as a discrepancy between the environment variable names in `SKILL.md` (`FEISHU_WEBHOOK_URL`) and the code (`WECOM_WEBHOOK_URL`), and a call to an undefined function `tavily_search` in the weather module—these are unintentional coding errors rather than security vulnerabilities or malicious logic.