News Sum

新闻汇总与邮件投递技能。当用户要求"生成今日新闻汇总"、"把新闻发给邮箱"时触发。支持：(1) 接收用户指定主题，搜索生成新闻汇总；(2) 按用户要求投递到指定邮箱。

Before installing or enabling this skill, verify these points: (1) Confirm how email sending will be authenticated: the SKILL.md uses 'gog gmail send' but the skill declares no required binary or any credentials — ask the author where 'gog' comes from and what credentials it needs. Do not provide broad Gmail/SMTP credentials until you trust the CLI and source. (2) Resolve the contradiction about temporary files: the skill says 'convert in memory, no temp files' but also attaches a file path; ensure attachments are created only in a controlled workspace path. (3) Command injection risk: the send command interpolates user-supplied EmailTarget and HTML into a shell command. Make sure placeholders are properly escaped or use an API/SDK instead of raw shell formatting. (4) Review privacy: the skill will fetch many web pages (English + Chinese results) and may include scraped content in outgoing emails; confirm you are comfortable with that data leaving your agent. (5) If you proceed, require the author to declare the exact binary dependency and the minimal credential scope (e.g., a dedicated, limited-scope SMTP account or OAuth token), or modify the skill to use the platform's audited mail API to avoid shell/credential issues.

Type: OpenClaw Skill Name: news-sum Version: 1.0.0 The news-sum skill implements a multi-agent workflow for news aggregation and email delivery. A significant security risk is identified in `SKILL.md`, where the email delivery function uses a shell command (`gog gmail send`) that wraps dynamic HTML content inside a subshell `$(printf '%s' ...)`. This pattern is highly susceptible to shell injection if the aggregated news content contains malicious sequences. While the logic appears aligned with its stated purpose, the unsafe handling of shell execution warrants a suspicious classification.