ClawHub

Daily Tech

v1.0.0

每日AI与科技领域要闻速览，中英双语精美新闻卡片。Daily AI and tech news briefing — bilingual EN/CN visual cards. Trigger on：科技日报、科技新闻、AI新闻、技术日报、今日科技、最新科技、创业新闻、daily tech、tech news、A...

⭐ 1· 37·0 current·0 all-time
by@jiajiaoy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (daily tech news, bilingual cards) matches the SKILL.md instructions to web_search, curate stories, produce an HTML artifact, and the included scripts implement push scheduling and per-user settings. The push management scripts and the content-generation instructions are proportionate to the stated purpose.
ℹ
Instruction Scope
SKILL.md instructs the agent to run web_search, curate 5–6 stories, and save a single HTML file to /mnt/user-data/outputs/daily-tech.html — all within the skill's purpose. The scripts (morning/evening) emit prompt text rather than performing network calls; push-toggle prints scheduling markers (__OPENCLAW_CRON_ADD__/__OPENCLAW_CRON_RM__) for the platform to consume. Nothing in the instructions asks the agent to read unrelated files or environment secrets. Note: the HTML template includes ad-slot divs and fixed 'Powered by ClawCode' branding (expected but worth awareness).
✓
Install Mechanism
No install spec or external downloads. This is instruction-first with small local Node.js scripts. No archives or remote installers are fetched.
✓
Credentials
The skill declares no required environment variables, credentials, or external config paths. The Node.js runtime metadata (node >=18) is reasonable given the included scripts. The scripts only read/write local per-user JSON under data/users and do not request secrets.
ℹ
Persistence & Privilege
always:false and normal model invocation apply. The push-toggle script emits platform-specific cron add/remove markers to schedule recurring jobs; this provides persistence (scheduled runs) which is expected for a push service. These scheduled tasks run simple local scripts that emit prompts — they do not themselves exfiltrate secrets. If you enable push for a channel (telegram/feishu/slack/discord), scheduled messages will be sent to that channel via the platform's scheduling mechanism.
Assessment
This skill appears coherent and low-risk: it uses web search to compile news and includes local Node.js scripts to manage per-user scheduled pushes. It requests no credentials and installs no remote code. Before enabling pushes: (1) review the data/users directory to see what settings will be stored, (2) test with a non-production userId to confirm behavior, (3) be aware scheduled runs will cause the agent to perform web searches and post to the chosen channel (telegram/feishu/slack/discord) via the platform — ensure you want automated outgoing posts, (4) note the generated HTML includes ad-slot placeholders and a fixed footer branding. If you do not want persistent scheduled jobs, do not run push-toggle.js on <yourUserId> or run 'node push-toggle.js status <userId>' to inspect current settings.

Like a lobster shell, security has layers — review code before you run it.

latestvk979e0hxx3wc6rttn79h9x4fqn842ztm

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments