NewsAPI Search
Analysis
This skill appears to do what it says—query NewsAPI—but it uses a local NewsAPI key and sends searches to newsapi.org, while the registry metadata does not declare those requirements.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none
The registry metadata does not declare the Node runtime or NEWSAPI_KEY credential, even though SKILL.md and the scripts require them.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
const envPath = path.join(process.env.HOME, '.openclaw', '.env'); ... const API_KEY = process.env.NEWSAPI_KEY; ... apiKey: API_KEY
The script reads a local OpenClaw env file and uses NEWSAPI_KEY as an API credential for NewsAPI requests.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
const url = `https://newsapi.org/v2/everything?${params.toString()}`;Search terms, filters, pagination values, and the API key are sent to the external NewsAPI provider as part of the intended API call.