Daily Brief
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill contacts third-party services and displays their returned content.
The skill uses curl to contact external weather and news endpoints. This is expected for a daily brief skill, but users should know it sends the requested city to wttr.in and relies on external content.
local weather=$(curl -s "wttr.in/$CITY?format=3" 2>/dev/null) local hot_data=$(curl -s "https://top.baidu.com/api/board?platform=wise&tab=realtime" 2>/dev/null)
Use it only if you are comfortable with those public services receiving the city query and providing the brief content.
The skill may fail if curl is unavailable, and the listed homepage does not provide a useful upstream source.
The homepage is a placeholder and the artifact declares curl, while the registry-level requirements list no required binaries. This is an incomplete packaging/provenance signal, though the included script is small and reviewable.
"homepage": "https://github.com/yourusername/daily-brief",
"requires": {
"bins": ["curl"]
}Inspect the included script before installing and ensure curl is available if you plan to use the skill.
Users may expect narrower output than the script actually provides.
The documentation advertises weather-only and news-only modes, but the provided script does not implement option parsing and always runs both sections. This is a misleading feature claim, not evidence of harmful behavior.
# 仅天气 daily-brief --weather-only # 仅新闻 daily-brief --news-only
Do not rely on the documented --weather-only or --news-only examples unless the script is updated to implement them.