Dinstein Tech News Digest
v3.15.0Generate tech news digests with unified source model, quality scoring, and multi-format output. Six-source data collection from RSS feeds, Twitter/X KOLs, Gi...
⭐ 0· 100·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (multi-source tech digest) align with what the repo contains: fetchers for RSS/Twitter/GitHub/Reddit/web, merging, scoring, templates, and delivery scripts. The declared required binary (python3) and the optional API keys/tools (Twitter backends, Brave/Tavily keys, GitHub token/APP fields, mail/gog/weasyprint/openssl) are all reasonable for the described data collection and delivery functionality.
Instruction Scope
SKILL.md instructs the agent to run the pipeline scripts, read default configs and workspace archive for deduplication, and write temporaries and archive outputs — all coherent with digest generation. The instructions explicitly warn about shell safety and not interpolating untrusted content into shell args. Note: the pipeline will read workspace archive files (user workspace) and optional GH_APP_KEY_FILE if provided; users should verify what they allow the skill to read in their workspace.
Install Mechanism
No install spec is provided (instruction-only for the agent), so nothing is automatically downloaded or executed beyond the repo scripts. Dependencies are documented in requirements.txt / README (pip install -r requirements.txt) but not installed by an automated installer — this lowers supply-chain risk. User must manually install Python deps if desired.
Credentials
All listed environment variables are optional and correspond to external APIs the skill integrates with (Twitter/X backends, Brave/Tavily web search, GitHub token or GitHub App fields). This is proportionate. Minor inconsistencies: CHANGELOG and README mention a new GetXAPI backend and a GETX_API_KEY env var, but GETX_API_KEY does not appear in the SKILL.md env list provided — small doc drift. Also, GH_APP_KEY_FILE is accepted (path to a private key PEM) — if you supply it the skill will read it to create app tokens (openssl is optional bin); only provide such sensitive files if you trust the skill.
Persistence & Privilege
always:false and user-invocable:true (default) — no force-installed permanent privilege. The skill writes only to /tmp and its workspace archive directory and does not request or change other skills' configs. Autonomous invocation is allowed (platform default) but not combined with 'always:true' or broad unexplained credential access.
Assessment
This skill appears to do what it says: fetch and merge tech news and produce templates for Discord/email/PDF. Before installing or running:
- Only set API keys you actually need (Twitter, Brave/Tavily, GitHub). All such env vars are optional; if you don't provide them the pipeline will run with reduced capability.
- If you plan to enable GitHub App token generation, review and protect the GH_APP_KEY_FILE (private key PEM); the code invokes openssl (declared optional) to sign JWTs. Provide the PEM only if you understand and trust that use.
- The repo suggests pip dependencies (requirements.txt) but there is no automated installer — install Python deps in a controlled environment (venv/container) before running.
- The pipeline reads your workspace archive (<workspace>/archive/tech-news-digest/) to deduplicate previous digests — ensure sensitive content isn't stored there if you don't want it read.
- If you will use the email delivery options (msmtp/mail or gog), verify those CLIs are configured locally (they rely on local mail client configuration) and inspect scripts/send-email.py to confirm behavior and destination handling.
- Note minor doc drift: README/CHANGELOG mention GETX_API_KEY but SKILL.md's env list omits it; be cautious if you plan to use that backend and check the latest code for the exact env var name.
Recommendation: run the pipeline in an isolated environment (virtualenv or container), review send-email.py and any delivery-related config, and only provide secrets for services you actually intend to use.Like a lobster shell, security has layers — review code before you run it.
latestvk97edpqk2q2t0wwykjmcda6vbh83h5v7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
