AI News Pusher
v2.2.2AI新闻自动获取与推送Skill v2.2。新增智能产品价值评分、高质量信源过滤、三级分类机制和人工反馈迭代。支持Tavily、Brave、RSS多新闻源聚合，无需API Key即可使用RSS源。当用户需要获取AI行业最新动态、自动化新闻推送、多源新闻聚合或智能内容过滤时触发此Skill。
⭐ 1· 377·0 current·0 all-time
by@kern1x
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implemented functionality: multi-source news fetching (Tavily/Brave/RSS), scoring (rules + optional LLM), local persistence, manual review, and optional push to Feishu. Optional env vars (FEISHU_WEBHOOK_URL, OPENAI_API_KEY, ANTHROPIC_API_KEY, TAVILY_API_KEY, BRAVE_API_KEY, OPENCLAW_GATEWAY_*) correspond to features documented in SKILL.md.
Instruction Scope
SKILL.md and scripts instruct the agent to run local Python scripts, read/write JSON files under a local data directory, query RSS/Brave/Tavily APIs, call optional LLM APIs for scoring, and POST to a user-supplied Feishu webhook. There are no instructions to read unrelated system secrets, contact hidden endpoints, or exfiltrate arbitrary environment data beyond the declared keys.
Install Mechanism
No install spec is provided (instruction-only install), and dependencies are normal Python packages (requests, feedparser, optional tavily/openai/anthropic). No downloads from untrusted URLs or archive extraction steps are present in the metadata.
Credentials
Requested environment variables are proportionate to features: API keys for news sources and LLMs and a Feishu webhook are expected. The SKILL.md explicitly warns that OPENCLAW_GATEWAY_TOKEN is highly sensitive because it can allow scheduling/external control — this is legitimate for the scheduling feature but requires caution. No unrelated credentials are requested.
Persistence & Privilege
Skill is not always-on, does not require forced inclusion, and does not modify other skills or system-wide configs. It persists data only to a local 'data' folder (data_storage.py) — appropriate for the described history/feedback features.
Assessment
This skill appears to implement exactly what it says: aggregate AI news, optionally score them with an LLM, persist results locally, and push to Feishu. Before installing or enabling automated runs: 1) Keep API keys and FEISHU_WEBHOOK_URL secret (do not commit to repos). 2) Only set OPENCLAW_GATEWAY_TOKEN if you understand and trust the gateway/service used for scheduling (the skill warns this is highly sensitive). 3) Run initial tests in dry-run mode (push_to_feishu.py --dry-run) and inspect generated messages and local data/feedback files under the skill's data directory. 4) Review schedule_push.py (scheduling code) before creating automated jobs. 5) Be aware the LLM integration will incur usage on whichever provider you configure. The code has some minor implementation quirks (e.g., LLM client usage and small date-handling bugs) but nothing that contradicts the declared purpose or indicates covert exfiltration.Like a lobster shell, security has layers — review code before you run it.
aivk9756b37p4pevrswc5f5ssen1s82430sbravevk9756b37p4pevrswc5f5ssen1s82430sfeishuvk9756b37p4pevrswc5f5ssen1s82430slatestvk97db1cqvp4eqrge90347d8p9h82ee7bnewsvk9756b37p4pevrswc5f5ssen1s82430srssvk9756b37p4pevrswc5f5ssen1s82430stavilyvk9756b37p4pevrswc5f5ssen1s82430s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.