newsnow-reader
v1.0.5优雅地阅读实时热门新闻。支持微博、知乎、百度、抖音、华尔街见闻、今日头条、澎湃新闻等8个主流平台。
⭐ 0· 458·6 current·6 all-time
byEmilio Luettgen@castieler
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (read real‑time hot news from 8 platforms) aligns with the included scripts: fetch_news.py implements per‑platform fetchers and format_news.py formats output. No unrelated env vars, binaries, or install steps are requested.
Instruction Scope
SKILL.md tells the agent to run the provided Python scripts which make outbound HTTP requests to the listed news platforms. That is within the declared purpose, but the instructions and code explicitly: generate fake Weibo cookies, automatically request login.douyin.com to collect Set-Cookie headers, and otherwise perform scraping. These are network‑heavy operations and may have side effects (rate limits, anti-bot triggers). The skill does not read local files or environment variables beyond what the scripts need.
Install Mechanism
There is no install spec; this is an instruction+script bundle. No third‑party packages or remote downloads are requested, and the code uses only the Python standard library as claimed.
Credentials
The skill requests no credentials or env vars (consistent). However, it claims to 'automatically generate' cookies and to auto‑obtain Douyin session cookies — this is a behavior that could be misleading (it does not require or ask for user secrets but simulates/collects cookies from remote endpoints). No cross‑service credentials are requested.
Persistence & Privilege
The skill is not always-enabled and requests no persistent system privileges. It does not modify other skills or system configs. Autonomous invocation is allowed (platform default) but not combined with unusual privileges.
Assessment
This skill appears to do what it says: run the included Python scripts to fetch and format hot news. Before installing or running it: 1) be aware it will make outbound HTTP requests to multiple third‑party domains (Weibo, Zhihu, Baidu, Douyin, WallstreetCN, Toutiao, ThePaper). 2) The fetchers generate or obtain cookies automatically (fake Weibo cookies, auto‑fetch Douyin Set-Cookie) — this may be unreliable, could trigger anti‑scraping protections, and may violate some sites' terms of service. 3) Run in an isolated environment or a machine without sensitive network access if you are concerned about outbound traffic. 4) If you need auditability, review the full fetch_news.py (ensure there are no hidden endpoints) and test with rate limits and timeouts. 5) If you expect production reliability, plan for handling site API/HTML changes and legal/ToS considerations for scraping.Like a lobster shell, security has layers — review code before you run it.
latestvk972hsn6kykt4htp0hxx5narnx82khw1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.