Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Daily Brief

Get daily weather and top news for multiple cities with one command, no API keys needed.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 48 · 2 current installs · 2 all-time installs
byhello@piaomiao123
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to deliver weather and top news without API keys; the script uses curl to wttr.in and top.baidu.com which is coherent with that claim and the metadata lists curl as a requirement. However, the SKILL.md advertises support for multiple cities, --weather-only/--news-only flags, and a ~/.daily-brief/config.json customization file, none of which are implemented in daily-brief.sh (the script accepts a single positional city argument and has no flag or config parsing). Metadata author/homepage strings appear generic/placeholder and differ from the registry owner ID.
!
Instruction Scope
Runtime behavior is limited to outbound HTTP requests (wttr.in and top.baidu.com) and printing to stdout, which is expected. The concern is a scope mismatch: SKILL.md instructs editing and using ~/.daily-brief/config.json and shows CLI flags, but the actual script does not read that config or parse flags—this mismatch could mislead users and cause unexpected behavior if they rely on features that don't exist.
Install Mechanism
There is no install spec and no external archive downloads; the skill is instruction-only with a bundled shell script. That minimizes install-time risk. It does require curl to be present (declared in metadata).
Credentials
The skill requests no environment variables, no credentials, and no config paths programmatically. The script performs network requests to public endpoints only and does not read secrets or local configs.
Persistence & Privilege
The skill does not request permanent presence, does not set always:true, and does not modify other skills or system-wide configuration. It simply runs the included script when invoked.
What to consider before installing
This skill's script appears benign (it just calls wttr.in and a Baidu hot-list endpoint and prints results), but the documentation overpromises features the script doesn't implement. Before installing or relying on it: 1) Inspect and run daily-brief.sh locally to confirm behavior; it will make outbound HTTP requests (the remote services will see your IP). 2) Be aware the advertised config file (~/.daily-brief/config.json) and CLI flags aren't used by the script—if you need those features, either modify the script or request an updated version. 3) Verify the author/homepage if provenance matters (the bundled homepage is a placeholder). 4) If you are concerned about network calls, run it behind a firewall or sandbox to observe where it connects. If the mismatches (flags, multiple-city support, config) are acceptable as 'documentation bugs', the skill is low-risk; if you need the advertised features, treat this as incomplete/untrusted until fixed.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.1
Download zip
latestvk97bt8vx4mtvep4j27d0accwpx832dbr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Daily Brief 每日简报

一键获取每日天气和热门新闻,省时又实用!

Features

  • 🌤️ 实时天气查询(免API key)
  • 📰 热门新闻聚合
  • 📋 一键生成精美简报
  • 🌍 支持多个城市

Quick Start

# 获取默认城市(上海)的天气和新闻
daily-brief

# 指定城市
daily-brief Beijing

# 仅天气
daily-brief --weather-only

# 仅新闻
daily-brief --news-only

Weather

使用wttr.in,免费免key!

curl -s "wttr.in/Shanghai?format=3"

News

使用免费新闻源,无需API key!

# 可以扩展更多新闻源

Output Format

📅 2026-03-16 每日简报

🌤️ 天气: 上海: ⛅️ +18°C

📰 热门新闻:
1. 新闻标题1
2. 新闻标题2
3. 新闻标题3

💡 今日提示: 记得带伞!

Customization

编辑 ~/.daily-brief/config.json 来配置默认城市和新闻源。


Made with ❤️ for OpenClaw

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…