News Monitor

Real-time news aggregator with Discord & Telegram push. Manage Jin10, BlockBeats, RSS, X KOLs, Polymarket, OpenNews via REST API.

This skill appears to be what it claims (a node-based news aggregator) but it asks you to fetch and run code from an external GitHub repo and to host an HTTP admin API that can be left unauthenticated. Before installing: (1) review the upstream repository source code yourself (or request the code be bundled into the skill) to check for concealed network exfiltration or privileged operations; (2) run it inside an isolated environment (container or VM) with limited network and file access; (3) set a strong dashboard.password and avoid leaving it blank; (4) do not supply production credentials (Discord webhooks, Telegram bot tokens, API keys) until you trust the code; (5) if you must run on a host, bind the service to localhost only and firewall the port; (6) prefer a skill that includes audited code in the bundle or is published from a known/verified source. If you want, I can list exact files or code locations to inspect next (e.g., startup scripts, config handling, outgoing request logic).

Type: OpenClaw Skill Name: news-monitor Version: 1.0.0 This skill is classified as suspicious due to its reliance on external, potentially mutable, resources and the broad permissions it requires. The `SKILL.md` instructs the agent to `git clone` a repository from GitHub (`https://github.com/zxcnny930/buzz.git`) and then run `npm install`, which can execute arbitrary code from external npm packages. The `package.json` explicitly requests the `exec` tool, granting the agent the ability to run arbitrary shell commands. Furthermore, the skill is designed to handle and transmit sensitive API keys/tokens (e.g., Discord, Telegram, 6551.io, Grok/OpenAI) and allows configurable external API endpoints, increasing the attack surface for potential data exfiltration if the external repository, npm packages, or the local service itself were compromised.