有色小鑽風 · Nonferrous Daily

This skill is functionally coherent with its advertised goal (scraping public metal-price sources and sending a Telegram daily briefing), but there are a few red flags you should consider before installing: - Registry metadata omission: The registry claims no required environment variables, but the code and SKILL.md require TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Expect to provide a Telegram bot token (a secret) and a target chat ID for the skill to post messages. Do not paste tokens into public places. - Telegram token risks: The provided bot token allows the code to send messages as your bot. Only use a bot token with limited scope and add the bot to a controlled chat or channel. If you want to be cautious, create a dedicated bot and chat for testing. - Network egress / scraping: The scripts make many outbound requests to third-party sites (Yahoo, CCMN, SMM, Westmetall, Reddit, Google News, Stooq, etc.). This is expected for the purpose but means the host running the skill must allow network access; review whether that is acceptable for your environment. - Review and run in a sandbox: Because the skill code runs Node.js and spawns child processes, run it first in an isolated environment (local dev machine, VM, or container) and inspect .env.example and code. Confirm there are no hidden endpoints or unexpected destinations in the code you didn't notice. - Operational reliability: The code contains many site-specific scrapers and tests to bypass Cloudflare-like blocks; this is a reliability concern (breaks if sites change) but not necessarily malicious. Expect maintenance. - What would change this assessment: if the registry metadata were corrected to declare the required TELEGRAM_* env vars (and optional keys) and the source/repo were a verified/known account (homepage/source present), the classification could be downgraded to benign. Conversely, any evidence of hidden remote endpoints, secret exfiltration, or opaque installers would raise the severity. Recommended next steps: inspect .env.example, run the scripts locally with dummy tokens to verify behavior (they will error sending to Telegram if tokens are invalid), and limit the bot/chat scope before connecting real channels.