Security audit
Security checks for vulnerabilities and agentic risk
This looks like a real daily tech-news skill, but its automatic delivery, hard-coded Feishu target metadata, broad triggers, and inaccurate source/filtering claims need review before installation.
Review and edit config.json before installing, especially the Feishu push_target user_id and any webhook configuration. Install only if you want a scheduled Chinese-language tech-news workflow, and verify whether cron-config.json is honored automatically. Treat generated briefings as unverified drafts unless the source-fetching and AI/Cloud/ML filtering are corrected.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
return False
try:
resp = requests.post(
FEISHU_WEBHOOK,
json=payload,
timeout=10
The reported implementation appears to fetch from different RSS sources, use a GitHub search API instead of Trending, omit the promised AI/Cloud/ML filtering, and generate empty structured output. In the context of an automation skill, this discrepancy is risky because it can mask what data is really collected and how outputs are produced, defeating informed approval and reliable policy enforcement.
The reported implementation appears to fetch from different RSS sources, use a GitHub search API instead of Trending, omit the promised AI/Cloud/ML filtering, and generate empty structured output. In the context of an automation skill, this discrepancy is risky because it can mask what data is really collected and how outputs are produced, defeating informed approval and reliable policy enforcement.
The reported implementation appears to fetch from different RSS sources, use a GitHub search API instead of Trending, omit the promised AI/Cloud/ML filtering, and generate empty structured output. In the context of an automation skill, this discrepancy is risky because it can mask what data is really collected and how outputs are produced, defeating informed approval and reliable policy enforcement.
The reported implementation appears to fetch from different RSS sources, use a GitHub search API instead of Trending, omit the promised AI/Cloud/ML filtering, and generate empty structured output. In the context of an automation skill, this discrepancy is risky because it can mask what data is really collected and how outputs are produced, defeating informed approval and reliable policy enforcement.
The reported implementation appears to fetch from different RSS sources, use a GitHub search API instead of Trending, omit the promised AI/Cloud/ML filtering, and generate empty structured output. In the context of an automation skill, this discrepancy is risky because it can mask what data is really collected and how outputs are produced, defeating informed approval and reliable policy enforcement.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cp skills/tech-news-daily/.env.example skills/tech-news-daily/.env
The manifest describes a skill that aggregates GitHub Trending, 51CTO, and Baidu tech hot topics, filters AI/Cloud/ML content, and generates a structured briefing. However, the README states the skill also pushes results to Feishu and is configured to fetch from multiple RSS/API/web sources such as 极智新、GeekPark、雷锋网、Qbit、36Kr, and InfoQ, which materially expands the described behavior and data sources.
The natural-language instructions and activation phrase are entirely in Chinese, including the required manual trigger phrase. This can constitute a language/locale policy violation because the skill appears to force a specific language for use without documenting that limitation, offering alternatives, or obtaining user opt-in.
The skill advertises significant capabilities in prose and file structure, but does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that can access environment variables, local files, and the network, this creates an authorization ambiguity that can enable over-privileged execution and unintended access to secrets, files, or outbound endpoints.
The trigger phrases include generic requests like 'tech news' and '每日资讯', which are broad enough to match ordinary conversation. That can cause accidental invocation of a networked, file-writing, and possibly webhook-sending skill in contexts where the user only wanted general information, leading to unintended external actions.
The manual execution phrases '生成日报' and '推送科技资讯' are ambiguous and action-oriented without clarifying side effects. In this skill context, ambiguous commands are more dangerous because execution may trigger scraping, local persistence, counter updates, and optional outbound webhook delivery without a clear user acknowledgement.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
方案 B: 系统 crontab
# 编辑 crontab
crontab -e
# 添加条目
0 8 * * * cd /home/node/.openclaw/workspace && /usr/bin/python3 skills/tech-news-daily/tech-news-daily.py >> logs/cron.log 2>&1
The generated briefing does not appear to follow the skill’s stated scope of filtering for AI/Cloud/ML content, instead listing general trending repositories and broad tech items. This is dangerous because users may rely on the briefing for domain-specific situational awareness and make decisions based on mislabeled or low-relevance content, undermining trust and potentially hiding genuinely relevant items.
The footer states that all sources were verified, but the visible report only evidences GitHub API sourcing and does not substantiate broader verification. This is dangerous because it creates a false assurance of source validation, which can mislead users into over-trusting the briefing’s accuracy, provenance, and editorial checks.
The briefing content is presented entirely in Chinese, including headings and summary text, with no indication that language selection is optional or that the skill is specifically limited to a Chinese-language audience. This creates a natural-language policy concern because it imposes a locale/language choice without user opt-in.
The generated briefing does not reflect the skill’s stated purpose of filtering for AI/Cloud/ML content. Instead, it includes broad and unrelated GitHub trending items, which can mislead users into trusting the output as domain-filtered intelligence when it is not. In a news aggregation skill, this is a data integrity issue that can distort decisions or downstream automation.
The skill metadata promises aggregation from GitHub Trending, 51CTO, and Baidu hot-search technology sources, but the visible briefing cites only GitHub API as its data source. This creates a provenance mismatch and can cause users to rely on supposedly cross-source intelligence that was actually derived from a single source, undermining trust and potentially biasing the briefing.
The skill claims to filter for AI/Cloud/ML content, but the generated briefing prominently includes off-scope items such as proxy lists and DNS-tunneling/censorship-bypass tools. This creates a trust and safety gap: users may rely on the stated curation criteria, yet receive unrelated or risky content that was not properly filtered.
The briefing highlights potentially risky tools such as free proxy lists and DNS tunneling VPN software without any warning about legal, privacy, or security implications. In a news aggregation context, this can normalize or indirectly promote dual-use tools to users who may not understand the associated risks.
This manifest contains multiple Chinese-only source names, URLs, and keyword filters, effectively constraining the skill's content selection to Chinese-language sources and terms alongside some English ones. Because there is no accompanying indication of user-selectable locale or an explicitly documented region-specific purpose in this file, it may violate the policy against forcing a specific language or locale without user opt-in.
The manifest description says the skill automatically fetches GitHub Trending, 51CTO, and Baidu tech hot search content, implying a limited source set. This config enables many additional media sources such as 机器之心、量子位、智东西、36氪、InfoQ、钛媒体、雷锋网 and others, which broadens the actual aggregation behavior beyond the declared scope.
The config hard-codes a push target user_id and enables delivery behavior not disclosed in the skill description. Undisclosed outbound delivery can route collected or generated content to a specific account without user awareness, creating a privacy and abuse risk even if the pushed data appears limited to news summaries.
The script formats time with the 'zh-CN' locale and emits Chinese-language user-facing output by default. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
The manifest describes a multi-source daily tech news aggregator that automatically collects GitHub Trending, 51CTO, and Baidu hot-search tech content, then filters for AI/Cloud/ML topics. In the implementation, the only external data source used is a GitHub search API query, and there is no fetching or filtering logic for 51CTO, Baidu, or AI/Cloud/ML categories.
No suspicious patterns detected.