Skillv1.0.11

ClawScan security

AIMPACT x ME News - AI-Powered Information Hub for Web4 & AI · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 20, 2026, 7:28 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only news aggregation skill that fetches AI news from the listed agent.me.news API endpoints using curl and optionally pushes formatted reports via the platform's configured message tool; its declared requirements and behavior are coherent with its stated purpose.
Guidance: This skill appears internally consistent: it will call the listed agent.me.news API endpoints (using curl) and format results per format.md, and only pushes if your OpenClaw message channels are already configured. Before installing, verify you trust the agent.me.news domain; if you enable automatic pushes, confirm which channels are configured and test the skill manually first to ensure output and recipients are as expected. Because it's instruction-only, it does not install code or ask for credentials itself, but any pushes will use existing channel credentials already configured in your platform — limit or review those channel permissions if needed.

Purpose & Capability: okName/description (AIMPACT news aggregator) match the manifest and instructions: required binary is curl, declared data sources are ME News APIs on agent.me.news, and the skill's functions (fetch, filter, sort, format, optional push) align with the stated purpose.
Instruction Scope: okSKILL.md confines actions to reading local sources.md, calling the whitelisted API endpoints (prefer curl, web_fetch only as fallback), extracting fields, formatting per format.md, and optionally using the platform message tool to push — no unrelated file reads, credential requests, or external endpoints beyond the specified domain are present.
Install Mechanism: okInstruction-only skill with no install spec and no code files; nothing is written to disk and no external archives or package installs are requested.
Credentials: okThe skill requests no environment variables or credentials. It optionally uses the platform's configured message tool for push delivery, which is appropriate for a push-capable news skill; no unrelated secrets or config paths are requested.
Persistence & Privilege: okalways is false and the skill does not request persistent/system-wide changes or special privileges. It relies on platform tools and existing channel credentials (not provided by the skill) for optional push.