news-hot-hub

新闻热点数据聚合器——整合知乎、今日头条、AIBase三大平台热搜数据。支持单独获取任一平台热榜，也支持一次性获取所有平台数据并汇总输出。当用户提到"热搜聚合"、"全平台热点"、"各平台热门话题"、"热榜整合"、"热点数据采集"、"我要看全网热点"、"刷一下各平台热榜"、"一键获取热榜"、"知乎头条热榜"、"全网...

This skill appears to do what it claims: it runs local Python scripts to fetch hot-search data from Zhihu, Toutiao and AIBase and outputs JSON. Before installing, consider: (1) pip install -r requirements.txt will download packages from PyPI — run in a virtualenv or sandbox. (2) The scripts make outbound HTTP requests to the listed domains (zhihu.com, toutiao.com, news.aibase.cn) — ensure outbound network access is acceptable. (3) You should only set ZHIHU_COOKIES if you understand and trust the code and are comfortable exposing your browser cookie string to the environment (that cookie is sensitive). (4) hub.py executes the bundled scripts via subprocess.run, so the bundled scripts will execute as code on the host — review scripts if you need to verify they match your policy. (5) If you require stronger isolation, run the skill inside an isolated VM/container or review/modify the scripts to remove any functionality you do not want.

Type: OpenClaw Skill Name: news-hot-hub Version: 1.0.2 The news-hot-hub skill bundle is a functional news aggregator that scrapes hot search data from Zhihu, Toutiao, and AIBase. The code follows a modular architecture where a central dispatcher (hub.py) safely executes platform-specific scripts (zhihu.py, toutiao.py, aibase.py) using subprocess.run with list-based arguments, preventing shell injection. There is no evidence of data exfiltration, malicious persistence, or prompt injection; the use of environment variables like ZHIHU_COOKIES is documented for legitimate authentication purposes in future versions.