AIPM DeepNews Daily
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill appears to do what it advertises: fetch public AI news feeds, translate them, and save a local digest, with only ordinary dependency, network, and cache considerations.
This looks safe for its stated purpose. Before installing, be comfortable with pip-installed dependencies, outbound network access to RSS feeds and Google Translate, and local files named latest_digest.md and seen_articles.json being written in the skill directory.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill pulls code from the Python package ecosystem before the script can run.
The setup step installs third-party Python packages, including an unpinned feedparser dependency and a release-candidate googletrans version. This is expected for an RSS translation script, but users should install from a trusted environment.
python3 -m venv venv && ./venv/bin/pip install feedparser googletrans==4.0.0-rc1
Use a virtual environment, consider pinning all dependency versions, and install only from trusted package sources.
Fetched article text and request metadata may be processed by an external translation service.
Article titles and summaries are sent to the translation provider through googletrans. The content appears to come from public RSS feeds and this behavior matches the stated translation feature.
result = await translator.translate(text, src="en", dest="zh-cn")
Run this only if external translation is acceptable, and review the code before adding private or internal feeds.
The skill keeps a small local history of processed articles so later runs can skip duplicates.
The script persists a local cache of seen article identifiers to avoid duplicates, and load_cache cleans records older than seven days. This is purpose-aligned local state.
CACHE_FILE = Path(__file__).parent / "seen_articles.json"
Delete seen_articles.json if you want to reset the digest history.