ai-news-daily-v1.0.4

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears aligned with its AI news aggregation purpose, but it will create a recurring OpenClaw news push and uses external dependencies/APIs that users should review.

Before installing, decide whether you want a daily scheduled news push. Use a Python virtual environment, review the cron job after first run, and only configure Telegram, Discord, or translation API credentials if you intentionally want those external services enabled.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

You may receive automated daily messages until the OpenClaw cron job is disabled or removed.

Why it was flagged

The skill discloses persistent scheduled activity that will continue sending daily news after setup.

Skill content

安装后自动创建 OpenClaw 定时任务，每天早上 9:00 推送到对话框

Recommendation

After installing, review the created cron job and remove or disable it if you do not want recurring news pushes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future installs may resolve to newer dependency versions than the author tested.

Why it was flagged

The skill depends on external Python packages using minimum-version ranges rather than exact pinned versions or hashes.

Skill content

requests>=2.28.0
feedparser>=6.0.0
beautifulsoup4>=4.11.0
trafilatura>=1.4.0
pyyaml>=6.0
lxml>=4.9.0

Recommendation

Install in a virtual environment and consider pinning or reviewing dependency versions before use.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If enabled, the skill can use your configured messaging tokens or webhook to post news outside OpenClaw.

Why it was flagged

Optional push integrations can use messaging credentials from environment variables, although they are disabled by default.

Skill content

telegram:
    enabled: false
    bot_token: ""             # 从环境变量 TELEGRAM_BOT_TOKEN 读取
    channel_id: ""            # 从环境变量 TELEGRAM_CHANNEL_ID 读取
    
  discord:
    enabled: false
    webhook_url: ""           # 从环境变量 DISCORD_WEBHOOK_URL 读取

Recommendation

Only enable external push targets intentionally, use scoped credentials, and rotate/remove tokens if you stop using them.