Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Daily News Vnexpress

v1.0.2

Fetch the latest trending global news from https://vnexpress.net/rss/{topic}.rss.

0· 277·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match included artifacts: a Python script that fetches VNExpress RSS feeds using feedparser/requests/BeautifulSoup. Declared requirements and code are proportionate to the stated goal.
!
Instruction Scope
SKILL.md instructs the agent to 'remember user behaviour and write to USERS.md' (persistence of user preferences/behavior) and to 'treat the script output as verified headline data'. Writing user behavior to disk and treating scraped output as authoritative are outside the minimal scope of fetching and summarizing RSS headlines and have privacy/misuse implications. The instructions otherwise only invoke the local Python script and summarization.
Install Mechanism
No automated install spec included; typical instruction-only setup using pip and requirements.txt. Packages listed (beautifulsoup4, bs4, requests, feedparser) are expected for RSS parsing; nothing downloaded from arbitrary URLs.
Credentials
The skill requests no environment variables, credentials, or config paths. The script performs only HTTP fetches to vnexpress.net RSS URLs; requested resources are proportional to the purpose.
!
Persistence & Privilege
The SKILL.md explicitly tells the agent to write user behavior to USERS.md (a persistent file) even though USERS.md is not included in the manifest. Persistent storage of user behavior can leak personal data or create unwanted telemetry; the skill does not justify this persistence or specify what is stored.
What to consider before installing
This skill appears to do what it says (fetch VNExpress RSS) but has two things to watch for: 1) Persistence: SKILL.md tells the agent to 'remember user behaviour and write to USERS.md' but USERS.md isn't included. Before installing, ask what will be written to that file, where it will be stored, and whether it may include PII. If you don't want persistent logs of user queries, block or inspect writes to USERS.md or remove that instruction. 2) 'Verified' output claim: the skill instructs agents to treat the script output as verified headline data. Scraped RSS content may be accurate but should not be treated as authoritative without source-checking. Ensure your agent or workflow does not automatically propagate unverified content as factual. Other actions: - Review the main.py locally (it only fetches vnexpress.net RSS and formats entries). Run it in a sandbox and inspect USERS.md behavior. - Check rate limits and network policies if this will be invoked frequently. - Optionally remove or modify the USERS.md persistence behavior if you want minimal data retention. Given these concerns (file persistence and authoritative-treatment instruction), proceed only after confirming/adjusting those behaviors.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e2292bkdxgtswesvqt89bb1834eg1
277downloads
0stars
2versions
Updated 4h ago
v1.0.2
MIT-0

Daily News Skill

This skill allows the agent to fetch the daily top news headlines from VNExpress News sources by running a Python script. The agent must treat the script output as verified headline data and avoid modifying the factual content.

Allowance

You are allow to use all scripts mentioned in this file

Quick Start

Setup Environment

python3 -m venv /data/nguyentk/AIHAY/OpenClaw/venv/openclaw_venv
source /data/nguyentk/AIHAY/OpenClaw/venv/openclaw_venv/bin/activate
cd /data/nguyentk/AIHAY/OpenClaw/workspace/workspace-daily_news_aihay/skills/daily-news-vnexpress
pip install -r requirements.txt

Instructions

Python main.py Script Description

Functionality:

  1. Fetches hot news from VNExpress RSS feeds based on specified topics
  2. Accepts input parameters: topics (comma-separated) and count_str (number of news per topic, comma-separated)
  • Example: --topics "tin-moi-nhat,giai-tri" --count_str "5,3" will fetch 5 news from "tin-moi-nhat" topic and 3 news from "giai-tri" topic

Details:

  1. Supports 18 predefined topics: "tin-moi-nhat", "the-gioi", "thoi-su", "kinh-doanh", "giai-tri", "the-thao", "phap-luat", "giao-duc", "tin-noi-bat", "suc-khoe", "doi-song", "du-lich", "khoa-hoc-cong-nghe", "oto-xe-may", "y-kien", "tam-su", "cuoi", "tin-xem-nhieu".

  2. Each news item contains: title, link, summary, and published date

Executing Instructions

When the user asks for latest news or trending global events:

  1. Ask the user for topics, if not provided, topics defaults: tin-moi-nhat, remember user behaviour and write to USERS.md

  2. Classify the user's question into one or more of the 18 predefined topics. Only select topics from this predefined list.

  3. Determine (count_str) that match user question.

  4. Execute the Python script to run:

python3 "{baseDir}/main.py" --topics "<topic>" --count_str "<count>"
  • Example: "Find me 7 latest news"
python3 "{baseDir}/main.py" --topics "tin-moi-nhat" --count_str "7"
  1. The script will collect and format the latest news headlines.
  2. Paraphrase and summarize those relevant news items clearly.
  3. Present them as the final response.

Comments

Loading comments...