geeknews-bot

매일 GeekNews(news.hada.io)에서 오늘의 HOT 이슈 5개를 큐레이션하고, 오픈소스 출시·GitHub star 급상승 프로젝트를 우선 선정하여 텔레그램으로 전송하는 데일리 브리프 에이전트 스킬. 사용자가 "긱뉴스 요약", "오늘 개발 뉴스", "OSS 뉴스", "텔...

Things to consider before installing or running this skill: - Required credentials are not declared in the registry metadata. The runtime needs TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID (mandatory) and the run script requires ANTHROPIC_API_KEY (it will exit if missing). It also recommends GITHUB_TOKEN to avoid rate limits. Don't run the cron script unless you intend the pipeline to call Anthropic. - Implementation mismatch: SKILL.md describes scraping/RSS fallback, but the provided automation delegates to Anthropic's API (claude) with a web_search tool. If you prefer local scraping (so content never leaves your host), you'll need to implement that yourself or modify run_geeknews_brief.sh. Running as-is will transmit prompts and rely on Anthropic; evaluate whether that data flow (site URLs and prompt content) is acceptable. - Network endpoints used: api.anthropic.com (if ANTHROPIC_API_KEY set) and api.telegram.org. The Telegram bot token must be protected; any compromise of that token would allow message sends as your bot. Keep tokens in a secure place and avoid committing them to repo. - Review message contents: the script sends the full generated markdown via send_telegram.py. Ensure no sensitive information is included in the generated brief or prompt context (the prompt instructs the model to "check the main page" — the model/tool may retrieve and process site content). - Actionable steps: ask the publisher to update registry metadata to list required env vars; if you don't trust remote LLM calls, modify the pipeline to perform local RSS parsing/scraping and GitHub queries yourself; store tokens in a secure secret store; test send_telegram.py manually with a test bot/chat before enabling cron. Overall, the skill is not evidently malicious but has clear inconsistencies and a surprising dependency on an external LLM for the automated pipeline — treat it cautiously and correct the manifest and/or implementation before enabling automated runs.

Type: OpenClaw Skill Name: telegram-geeknews Version: 1.0.0 The skill is a legitimate utility designed to curate tech news from GeekNews and send daily summaries to a Telegram channel. It uses the Anthropic API for content summarization and the Telegram Bot API for delivery, requiring standard environment variables (TELEGRAM_BOT_TOKEN, ANTHROPIC_API_KEY) for operation. The code in scripts/run_geeknews_brief.sh and scripts/send_telegram.py is transparent, well-documented, and strictly follows the logic described in SKILL.md without any evidence of data exfiltration, obfuscation, or malicious intent.