reddit-digest

抓取指定单个 Subreddit 最近 24 小时热门 Post，逐一获取详情与评论，生成摘要、核心要点、可实践建议、灵感启发及社交媒体分享文案，输出为每日精选 Markdown 文档。 当用户说"帮我抓取/总结 Reddit r/xxx"、"生成 Reddit 每日摘要"、"reddit digest"时使用。

This skill appears to do what it says (fetch Reddit posts and produce a Markdown digest), but there are red flags you should address before installing or running it: - 'autocli' is a required runtime dependency (used by both the SKILL.md pipeline and the Python script) but it is not declared in the skill metadata. Verify you have a trusted 'autocli' binary installed and understand what permissions/sessions it uses (it is described as browser-based and may use your browser cookies/sessions). - SKILL.md references environment variables (REDDIT_DIGEST_BASE_DIR, REDDIT_DIGEST_SUBREDDIT) and uses a hard-coded default path (/Users/victor/...). Update those defaults and provide explicit paths to avoid writing into unexpected locations. - The skill runs a one-line background shell pipeline that writes logs to /tmp and creates temp directories. Review the exact command before running, and consider running it in an isolated environment (container or dedicated account) first. - Inspect the bundled script (scripts/fetch_post_details.py) yourself — it uses subprocess.run to invoke 'autocli'; ensure there are no unexpected network endpoints or commands you don't want executed. If you decide to proceed: install 'autocli' from a trusted source, set REDDIT_DIGEST_BASE_DIR to a safe directory you control, avoid running it while logged into sensitive browser accounts, and run the pipeline manually the first time to confirm behavior. If you cannot verify 'autocli', treat the skill as unsafe to run.

Type: OpenClaw Skill Name: reddit-digest Version: 1.0.3 The skill is a legitimate tool for scraping and summarizing Reddit subreddits using the 'autocli' utility. The Python script 'scripts/fetch_post_details.py' safely handles subprocess execution using argument lists to prevent shell injection and focuses entirely on data retrieval and local storage. While it contains a hardcoded local path (/Users/victor/...) in SKILL.md, this appears to be a configuration default rather than a malicious indicator.