今日头条热榜 | Toutiao Hot News

获取今日头条(www.toutiao.com)新闻热榜/热搜榜数据 | Get Toutiao (www.toutiao.com) news hot list/trending data 包含时政要闻、财经、社会事件、国际新闻、科技发展及娱乐八卦等多领域的热门中文资讯 | Includes politics, f...

This package mostly does what it says (scrapes Toutiao and stores results locally), but there are a few red flags to check before installing or running it: 1) The registry metadata declares no required binaries but the code requires Node.js and Python3 — ensure you have those and ask the author to declare them. 2) Inspect and (if needed) edit scripts/fetch-toutiao.py: it contains a hard-coded path to ~/.openclaw/workspace-tanluzhe/skills/toutiao-news-trends-0 which could cause the script to read/execute code from your home workspace unexpectedly; change it to use the local script (or remove that script if unused). 3) The code makes outbound HTTPS requests to https://www.toutiao.com — run it in an environment where that network access is acceptable. 4) Review file writes (data/toutiao.db and data/index.html) and back up or sandbox if you don’t want local files created. If the author provides an updated version that declares runtime requirements and removes the hard-coded workspace path, the package would be coherent; until then treat it with caution or run it in an isolated environment.

Type: OpenClaw Skill Name: toutiao-hot Version: 1.0.0 The skill bundle is a legitimate tool for scraping, archiving, and visualizing trending news from Toutiao (toutiao.com). It uses a Node.js script (toutiao.js) to fetch data from the public API and several Python scripts (db.py, save_to_db.py, init_db.py) to manage a local SQLite database and generate HTML reports (generate_html.py). While there is a minor SQL string formatting vulnerability in query.py, it is mitigated by integer type-casting in the command-line interface, and the overall behavior aligns perfectly with the stated purpose without any evidence of data exfiltration or malicious intent.