ClawHub

GNews CLI

v1.0.7

Use this skill when the user wants to install, configure, or troubleshoot the GNews binary from GitHub and fetch top headlines from GNews by country, categor...

⭐ 0· 231·1 current·1 all-time
byParin Lai@parinll
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill's declared purpose (install/configure/troubleshoot the GNews CLI) matches the runtime instructions and the single required secret (GNEWS_API_KEY). However, SKILL.md metadata declares 'go' as a required binary while the registry metadata lists no required binaries — this mismatch should be resolved so callers know that 'go' is needed to build from source.
✓
Instruction Scope
Runtime instructions are narrowly scoped to cloning the GitHub repo, building the binary with 'go build', optionally installing it to /usr/local/bin, exporting GNEWS_API_KEY, running the binary, and troubleshooting API/network issues. There are no instructions to read unrelated files, harvest other environment variables, or transmit data to unexpected endpoints.
ℹ
Install Mechanism
This is an instruction-only skill (no install spec). It tells users to git clone and build from a GitHub repo — a common approach but inherently trusts third-party source code. There is no automated download/install step from an untrusted URL in the skill itself, but building/running arbitrary code from GitHub carries the usual risks.
✓
Credentials
Only GNEWS_API_KEY is required and declared as the primary credential; that is proportional to the stated functionality. The skill also advises not to print full keys and treats API responses as untrusted input.
✓
Persistence & Privilege
The skill does not request persistent/always-on privileges. It suggests an optional global install that may require sudo, which is expected for placing binaries in /usr/local/bin. The skill does not attempt to modify other skills or system config beyond that.
Assessment
This skill appears to do what it says: guide you to build and run the GNews CLI and use GNEWS_API_KEY. Before installing, verify the GitHub repository (owner, recent commits, issues, stars) because building code from third‑party repos runs arbitrary code on your machine. Ensure you have the 'go' toolchain installed (SKILL.md expects it even though registry metadata omitted it). Avoid running 'sudo install' unless you trust the binary; prefer running ./gnews-client from the cloned directory or installing from a vetted release or package. Do not share your GNEWS_API_KEY, and follow the skill's advice not to log full API keys. If you want lower risk, run the build in a sandboxed environment (container or VM) and inspect the source or use an official release artifact.

Like a lobster shell, security has layers — review code before you run it.

clivk970f1h3b8wb427wgqph1kj29982yezrgnewsvk970f1h3b8wb427wgqph1kj29982yezrlatestvk970f1h3b8wb427wgqph1kj29982yezrnewsvk970f1h3b8wb427wgqph1kj29982yezr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvGNEWS_API_KEY
Primary envGNEWS_API_KEY

Comments