Paper Report Delivery

Build, automate, or maintain a daily paper-report delivery pipeline that collects papers, selects A/B groups, generates Chinese summaries and detailed innova...

Security Scan

The skill's files, instructions, and runtime behavior are coherent with its stated purpose (building and reliably delivering a daily paper-report to Telegram); it does not request unrelated credentials or install arbitrary remote code.

Purpose & Capability

Name/description (paper report -> generate HTML, Telegram messages, archive, retry/fallback) match the included scripts and README. The use of the OpenClaw CLI for sending messages is consistent with a delivery-oriented skill.

Instruction Scope

SKILL.md stays on-task (read workflow.md, build artifacts, deliver to Telegram, archive). The bundled scripts operate on local repo paths (data/, output/, assets/) and do not reach out to unexpected external endpoints. The delivery scripts call the OpenClaw 'message send' CLI via a retry wrapper, which is expected for sending to Telegram.

Install Mechanism

No install spec is provided (instruction-only with bundled scripts). No downloads from arbitrary URLs or archive extraction are present. The only external dependency is the OpenClaw CLI and Python runtime with Pillow for image handling, which are normal for this kind of skill.

Credentials

The skill does not declare or require secrets. It does read common env vars (TELEGRAM_TARGET, HTML_RETRY_WINDOW_SECONDS, etc.) and relies on the OpenClaw channel configuration for credentials, which is proportional to a Telegram delivery skill. There are no unrelated credentials or config paths requested.

Persistence & Privilege

always:false and the skill does not modify other skills or system-wide agent settings. It leaves local artifacts cached/archived per its stated behavior (which is expected for reliability and auditing).

Assessment

This skill appears coherent with its purpose, but review a few practical points before installing or running it: - Configure TELEGRAM_TARGET (and remove the placeholder) and ensure your OpenClaw 'channels.telegram' is correctly set up; the send script uses the platform's configured credentials to send messages. - There are no hard-coded credentials in the bundle, but verify there are no hard-coded chat IDs or targets before publishing/using. - The scripts call the OpenClaw CLI (openclaw message send). Running them will use whatever messaging credentials the OpenClaw config provides — run tests in a controlled environment to avoid accidental posting. - Ensure Python (and Pillow) is available in your environment since build_readable_html.py uses PIL for image conversion. - The skill intentionally persists local artifacts (output/, archives) for reliability; if those outputs might include sensitive data, clean or secure the output directory. - If you want stricter isolation, run the pipeline in a sandboxed container or CI job that has only the minimal OpenClaw credentials/targets needed. Overall, the package is internally consistent and on-purpose; the usual operational caution about message-sending credentials and output data applies.

Use this skill to implement or maintain an end-to-end daily paper report workflow.

Do this

1. Read references/workflow.md first.
2. Keep the pipeline end-to-end: collection, selection, readable output, archive, delivery.
3. Prefer Telegram-only proxying via channels.telegram.proxy when Telegram API needs Clash.
4. Treat Telegram message delivery and Telegram document delivery as separate reliability paths.
5. Prefer this delivery order:
   • split HTML delivery
   • retry for a bounded window
   • Telegram message chunk fallback
6. Keep local artifacts even when remote delivery fails.

Reusable scripts

Use these bundled scripts when they fit:

• scripts/build_readable_html.py
  • Build a readable single-file HTML report with embedded images.
• scripts/build_telegram_messages.py
  • Convert a readable report JSON into Telegram-sized message chunks.
• scripts/send_telegram_retry.sh
  • Retry Telegram sending for unstable transport.
• scripts/send_html_then_fallback.py
  • Try split HTML for up to 30 minutes, then fall back to Telegram message chunks.

Implementation rules

• Keep HTML as the best-reading artifact.
• Keep Telegram message chunks as the most reliable delivery artifact.
• Archive HTML, PDF, and markdown even when only Telegram text is delivered.
• Do not assume Telegram document delivery is stable.
• If Telegram is unreachable, finish artifact generation and leave cached delivery files behind.

When editing an existing repo

• Integrate into the repo’s main pipeline entrypoint instead of creating a disconnected side script.
• Add flags for skipping fetch, skipping send, and archive-only mode.
• Keep delivery logic explicit and observable in logs.
• If Telegram transport is flaky, add retries before changing report content.

Publishing hygiene

Before public release:

• Remove hard-coded local paths
• Remove hard-coded Telegram targets and group names
• Replace fixed dates with dynamic YYYY-MM-DD handling
• Keep transport settings configurable

Packaging

After the skill is complete, package it with the local package_skill.py helper from the OpenClaw skill-creator skill.