Ai Daily News By Fang

AI 技术进展追踪工具。当用户询问 AI 领域最新动态时触发，如："今天有什么 AI 新闻？""总结一下这周的 AI 动态""最近有什么技术进展？""AI 圈最近在讨论什么？"。专注追踪：模型发布（国际+国内）、AI 工具迭代（新工具/CLI/功能更新）、重要技术公告，社区爆火项目/论文、新理念/新范式/新实践。...

Security Scan

The skill's stated purpose (collecting AI technical news) is reasonable, but the runtime instructions expect local scraping scripts and an immediate Feishu push workflow that are not declared as requirements, creating coherence and data-exfiltration concerns.

Purpose & Capability

The skill's name and description match the behavior described in SKILL.md (fetch AI news, summarize, push a daily report). However, the instructions assume the presence of a specific local tool ('smart-web-fetch' at /home/fang/.openclaw/workspace/skills/smart-web-fetch/scripts/fetch.py) and a Feishu messaging tool without declaring those as required binaries, packages, or environment variables. That mismatch means the skill implicitly relies on external components not listed in its metadata.

Instruction Scope

The SKILL.md directs multi-round web scraping (including '直接爬取网页正文'), storing files under workspace/ai-daily-news, and then '立即' pushing the markdown report to Feishu (channel=feishu, target ou_YOUR_OPEN_FEISHU_ID). The scraping and immediate outbound posting are coherent with 'news collector' functionality, but the instructions also say '不要等用户来问' (push without user prompting). Combined with no declared constraints around which credentials or message API will be used, this grants the agent broad discretion to fetch arbitrary pages and send content externally. The SKILL.md references local filesystem paths and tools beyond the skill bundle (e.g., python script path, message tool) — the agent could read those paths or attempt to use other system credentials to accomplish the push.

Install Mechanism

This is an instruction-only skill with no install spec and no code files to execute from the bundle. That minimizes the risk of arbitrary code being installed by the skill package itself. The main risk arises from the instructions invoking external local tools and services rather than anything installed by the skill.

Credentials

requires.env lists none, and no primary credential is declared, but the runtime instructions expect use of a Feishu messaging capability and a local fetch script. Sending messages to Feishu will require credentials or an agent-integrated message tool with access to Feishu tokens; these are not declared. This is a proportionality mismatch: the skill expects outbound messaging and access to local scripts/paths but does not declare the environment variables or tokens it will use, making it unclear what credentials the agent will use and whether sensitive tokens might be leveraged.

Persistence & Privilege

The skill does not request always:true and does not include an install step that modifies other skills. It does instruct the agent to write daily files to workspace/ai-daily-news and to proactively push reports when a run completes. Because autonomous invocation is permitted by default, the combination of autonomous runs + instructions to 'immediately push' outbound messages increases blast radius if the agent has message tooling configured — this is not a direct privilege request by the skill, but it's a notable operational risk.

What to consider before installing

What to consider before installing: - The skill's instructions assume a local fetch script at /home/fang/.../smart-web-fetch/scripts/fetch.py and an available 'message' (Feishu) tool, but the skill metadata does not declare these dependencies or required credentials. Verify whether those tools actually exist and what permissions/tokens they use. - The skill is designed to proactively push daily reports to Feishu ('不要等用户来问'). If your agent or environment has Feishu tokens or an outbound messaging integration, the skill could send content automatically. If you don't want that, disable autonomous invocation for this skill or require manual confirmation before sending. - Inspect the referenced smart-web-fetch tool (and any message-sending integration) before granting the skill runtime access: review its code to see what it fetches, how it handles cookies/tokens, and where it sends data. - If you install it, prefer running it in a sandbox or with least-privilege messaging credentials (a dedicated Feishu bot/account with limited scope), and confirm the open_id replacement step is done manually so you don't accidentally leak identifiers. - Ask the skill author (or request an updated SKILL.md) to explicitly declare required binaries, environment variables, and the exact mechanism used to send Feishu messages, and to change the workflow so that pushes occur only after explicit user approval. If the author provides a clear dependency list (smart-web-fetch path or public pip package), documents the Feishu integration and required environment variables, and changes the default to require user approval before pushing, this assessment could move toward benign.

AI News Collector

核心原则

只追踪技术本身，不关心商业与政策。 不搜融资、不搜监管政策、不搜 IPO/并购。

不要口水新闻。 过滤掉"小扎紧急警报"、"老黄怒怼玩家"类标题党。聚焦：模型、工具、理念、出圈项目。

时间范围：3 天以内。 超过 3 天的内容不收录。Newsletter 补漏时只取最新一期。

多次检索，不是一次性搜索。 用多组关键词多轮检索，确保全面。必要时直接爬取网页正文。

---

输出文件

日报本体存本地：workspace/ai-daily-news/ai-daily-news-YYYY-MM-DD.md

每次完成后把内容通过飞书消息直接推送给用户（markdown 格式，飞书可渲染），无需依赖飞书文档权限。

格式：

# AI 日报 · YYYY-MM-DD

> 时间范围：近 3 天
> 来源：[量子位](url) · [机器之心](url) · [HN](url) · [Last Week in AI](url) · 等

## 模型

1. [标题](链接)
   > 摘要（30-50字，说明什么、为什么值得关注）

## 工具

...

## 研究/理念

...

## 出圈

...

---
_写入轮次：X 轮 · 共 N 条 · 更新时间：HH:MM_

---

工作流程（强制多轮，不是一次搜索）

第一轮：并行抓取主力来源

三个来源同时抓取：

量子位首页：https://www.qbitai.com
机器之心首页：https://www.jiqizhixin.com
HN 首页：https://news.ycombinator.com/

提取所有 AI 相关条目，标注发布时间，只保留 3 天以内的。

---

第二轮：多关键词多轮搜索补漏

第一轮之后，用以下关键词继续搜索，每次搜索发现新线索都要深入追查：

模型类关键词（并行搜）：

"new AI model" 2026
"GPT-5" OR "Claude" OR "Gemini" new version 2026
"DeepSeek" OR "Qwen" OR "Kimi" OR "MiniMax" new model
"LLM" OR "reasoning model" release 2026

工具类关键词：

"Claude Code" OR "Cursor" OR "Codex" new feature 2026
"AI CLI" OR "AI tool" new release 2026
"agent" OR "MCP" new update 2026

研究/开源类关键词：

"AI research" OR "paper" "2026" site:arxiv.org
"open source" AI model 2026
"GitHub" trending AI project

每发现一个新的重要发布，都要进一步搜索该厂商/项目的最新动态。

---

第三轮：针对重要条目直接爬取详情

对于前两轮发现的重要发布，直接爬取原始页面获取详细信息：

# 直接爬取官方页面（示例）
Astral 加入 OpenAI → https://astral.sh/blog/openai
Claude Code 更新 → https://code.claude.com/docs/en/changelog
OpenAI 新模型 → https://openai.com/index
Anthropic 新模型 → https://www.anthropic.com/news

用 smart-web-fetch 爬取正文，补充更准确的摘要。

---

第四轮：审视与淘汰

对所有收集到的条目逐一审查：

保留标准：

• 时间在 3 天以内
• 技术内容有实质（模型/工具/理念/出圈应用）
• 标题中性，无口水味
• 摘要说明"是什么+为什么值得关注"

淘汰标准（严格）：

• 超过 3 天
• 口水标题（感叹号多、情绪化词汇）
• 纯商业/融资/财报
• 过于日常化无技术含量的 AI 应用

---

第五轮（如有遗漏）：扩展来源

前三轮如果覆盖不足，主动扩展：

# 英文来源
HN 搜索：site:news.ycombinator.com AI &tbs=qdr:d
Reddit：site:reddit.com/r/MachineLearning AI &tbs=qdr:d
GitHub Trending：site:github.com/trending?since=daily AI

# Newsletter
Last Week in AI 最新一期（只取最新一期）
The Batch（Andrew Ng）最新一期

---

搜索工具说明

主力工具： smart-web-fetch

python3 /home/fang/.openclaw/workspace/skills/smart-web-fetch/scripts/fetch.py "<URL>"

搜索工具： smart-web-fetch + DuckDuckGo（加 &tbs=qdr:d 当天 或 &tbs=qdr:w 一周内）

python3 /home/fang/.openclaw/workspace/skills/smart-web-fetch/scripts/fetch.py "https://duckduckgo.com/html/?q=Claude+Code+new+feature+2026&tbs=qdr:d"

直接爬取重要页面：

python3 /home/fang/.openclaw/workspace/skills/smart-web-fetch/scripts/fetch.py "<官方页面URL>"

---

最终推送

生成完日报后，执行两步：

1. 本地存档：workspace/ai-daily-news/ai-daily-news-YYYY-MM-DD.md

2. 飞书消息推送（使用 message 工具，channel=feishu）：

   • 目标：ou_YOUR_OPEN_FEISHU_ID（替换为你的飞书 open_id）
   • 内容：完整的 markdown 日报内容（飞书可渲染）
   • 推送时机：日报完成后立即发送，不要等用户来问

安装后必读：请将 ou_YOUR_OPEN_FEISHU_ID 替换为你的飞书 open_id，将本地存档路径改为你想要的目录。

---

注意事项

• 3 天以内的硬性限制，超过即淘汰
• 多轮搜索：第一轮抓来源 → 第二轮关键词补漏 → 第三轮直接爬详情 → 第四轮审视淘汰 → 第五轮（如需）扩展来源
• 发现重要发布要深入追查，不要浅尝辄止
• 标题用中性技术语言，摘要说明内容和价值
• 不搜融资、IPO、并购
• 不搜监管、法律、政策
• 每次写入文件都要标注轮次
• 日报完成后立即推送飞书，不要等用户来问