spotify-news-digest

This skill appears to be what it claims (a Spotify news scraper and digest generator) but has some security caveats you should consider before installing or scheduling it: - The fetcher disables global SSL verification (ssl._create_default_https_context = ssl._create_unverified_context). That weakens TLS checks for the entire process and can expose you to man-in-the-middle attacks. Remove or change that line so HTTPS verification remains enabled. - The skill will fetch whatever URLs appear in search results and any custom sources you add to config/sources.json. Do not add internal or sensitive URLs (intranet, metadata endpoints) because the skill could inadvertently access them — run it in a network environment that does not expose sensitive internal services. - Run the skill in an isolated environment (container or limited VM) if you plan to schedule it, especially if the agent has network access to internal services or secrets. Consider pinning and auditing the pip dependencies from requirements.txt before installing. - Review and, if needed, restrict the list of sources in config/sources.json so the skill only queries well-known news domains you trust. - If you rely on the automatic posting feature, check what permissions OpenClaw will grant the scheduled job to post to channels/targets and ensure it won't post to public destinations you didn't intend. If you want, I can produce a minimal patch that removes the SSL bypass and adds explicit request timeouts and domain allowlists to reduce risk.