Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

News Briefing

v2.0.0

Real-time AI news briefing for any topic. Say "给我看大谷翔平的新闻" or "AI今天有什么大新闻", and your agent instantly searches the web, summarizes the top stories in Chinese,...

0· 402·9 current·9 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The SKILL.md description (real-time news search, Chinese summaries, Feishu cards) matches the code: fetch-news calls Perplexity, optional PPIO for insights, and send-card posts to Feishu. Required secrets in the README (FEISHU_APP_ID/SECRET, PERPLEXITY_API_KEY, optional PPIO_API_KEY) are exactly those the scripts use. Minor inconsistency: registry metadata listed 'Required env vars: none' while SKILL.md and scripts do require keys.
Instruction Scope
Instructions and scripts stay within the advertised scope (search, summarize, generate insight, send card). The code performs network calls to specified third-party APIs and writes/reads local files for outputs. Notable implementation concerns: many network calls are executed via shell (execSync + curl), which can be fragile and create command-injection risks if untrusted inputs are passed into shell commands; gen-cover writes to a root workspace path and constructs a large node -e command that embeds code, which is brittle and may execute unexpectedly in some environments.
Install Mechanism
No install spec (instruction-only), so nothing is automatically downloaded during install — lower risk. However, scripts assume Node and curl are available and gen-cover references a hard-coded pnpm/global module path for @napi-rs/canvas and system font paths; that is brittle and may fail or require manual dependency setup. There is no external archive URL or obscure downloader in the manifest.
Credentials
Requested environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET, PERPLEXITY_API_KEY, optional PPIO_API_KEY, HTTPS_PROXY, TARGET_USER_ID) are proportional to the stated functionality. The code only uses these variables and standard HTTP proxy vars; it does not request unrelated credentials.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or global configs. It writes a cover image into its own workspace path and otherwise runs as ephemeral scripts — no unusual persistence or elevated privileges are requested.
Assessment
This skill appears to do what it claims: search Perplexity, optionally call PPIO for insights, and post formatted cards to Feishu. Before installing or running it, consider: 1) You must provide FEISHU and PERPLEXITY (and optionally PPIO) API keys — grant least privilege and avoid using high-priv production credentials until you trust it. 2) The scripts use execSync and shell-constructed curl commands, which can be brittle and risk command injection if untrusted input is fed into the CLI; prefer running with controlled topic strings or sanitizing inputs. 3) gen-cover uses hard-coded system paths (pnpm global path, /root workspace, system fonts) and may fail or behave unexpectedly; run cover generation in a sandbox or skip it if you don't need images. 4) Test in a safe environment and verify Feishu messages go only to intended recipients (use dry-run and TARGET_USER_ID) before enabling scheduled runs with real credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk9740q0sarng42efv7natvwfx582dh81
402downloads
0stars
1versions
Updated 14h ago
v2.0.0
MIT-0

📰 News Briefing

让 AI Agent 成为你的私人情报官
任意话题 → 联网实时搜索 → 中文摘要 → AI深度洞察 → 飞书卡片,一句话触发。

为什么选 News Briefing?

普通新闻 AppNews Briefing
固定频道,被动推送任意话题,主动触发
只有标题/摘要AI深度洞察:背景、逻辑、影响、信号
英文/日文混杂全程中文输出
需要打开 App飞书卡片直达,不换 App
每天定时推送随时触发,也支持定时

快速开始

对话触发(最简单)

直接对你的 Agent 说:

看下大谷翔平的新闻
AI今天有什么大新闻
两会最新动态
帮我查一下特斯拉近期消息

Agent 自动调用 News Briefing,发卡片到你的飞书。

命令行调用

# 单主题
node {baseDir}/scripts/news-digest.mjs \
  --topics "全球AI科技动态" \
  --categories "AI" \
  --title "🧠 AI情报简报" \
  --target-user ou_xxx

# 多主题合并(每日日报)
node {baseDir}/scripts/news-digest.mjs \
  --topics "全球AI科技,时政要闻" \
  --counts "5,5" \
  --categories "AI,GEO" \
  --title "📰 每日情报简报" \
  --target-user ou_xxx

卡片效果

每条新闻:

🧠 标题(25字以内,中文)
摘要一句话说清(50-60字,手机2-3行)

[📄 查看原文]
💡 查看AI洞察 ▼
  📌 背景:为何发生
  🔍 深层逻辑:核心驱动力  
  💥 影响:行业/市场影响
  👁 关注点:值得追踪的信号

参数说明

参数说明默认
--topics主题(逗号分隔多个)必填
--counts每主题条数5
--categoriesAI/GEO/SPORT/BIZ/CUSTOMAI
--title卡片标题自动生成
--target-user飞书 open_id必填
--no-insight跳过 AI 洞察(更快)-
--date指定日期今天

环境变量

变量必须说明
FEISHU_APP_ID飞书 App ID
FEISHU_APP_SECRET飞书 App Secret
PERPLEXITY_API_KEY联网实时搜索(Perplexity sonar)
PPIO_API_KEY可选AI 洞察生成(缺少则跳过洞察)
HTTPS_PROXY可选代理地址
TARGET_USER_ID可选默认接收人 open_id

典型场景

# 🤖 AI 资讯
--topics "全球AI大模型最新进展" --categories "AI" --title "🧠 AI情报简报"
--topics "OpenAI/Anthropic/DeepSeek最新动态" --categories "AI"

# ⚾ 体育追踪
--topics "大谷翔平WBC最新动态" --categories "SPORT" --title "⚾ 大谷情报"
--topics "MLB道奇最新战报" --categories "SPORT"

# 🌍 时政财经
--topics "两会最新动态" --categories "GEO" --title "🏛️ 两会简报"
--topics "中美贸易最新进展" --categories "GEO"

# 💼 行业追踪
--topics "云计算IaaS市场动态" --categories "BIZ"
--topics "苹果最新产品消息" --categories "BIZ"

# 📰 每日综合日报(推荐配置)
--topics "全球AI科技,时政要闻" --counts "5,5" --categories "AI,GEO" --title "📰 每日情报简报"

定时推送(配合 OpenClaw Cron)

每天 8:30 自动推送:

# 在 OpenClaw 中设置 cron,执行:
node /path/to/news-briefing/scripts/news-digest.mjs \
  --topics "全球AI科技,时政要闻" \
  --title "📰 早间情报简报" \
  --target-user ou_xxx

OpenClaw 提供支持 · 作者: @derekhsu529

Comments

Loading comments...