ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Multisource Intel Radar

v0.1.1

Build and run a high-signal information radar for C-end founders and operators across YouTube, X/Twitter, Reddit, WeChat Official Accounts, and Xiaohongshu....

⭐ 0· 388·1 current·1 all-time
byRoger Yang@rogerrrr18
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description (multi-source radar across RSS/OPML + non-RSS sources) largely matches the included parsing and digest scripts which handle OPML -> feeds and RSS/Atom scoring. However the skill claims support for non-RSS sources (WeChat OA, Xiaohongshu) and browser search for XHS which are not implemented in the code; that capability mismatch is unexplained but could be intended as a manual step.
!
Instruction Scope
SKILL.md instructs parsing a user-specific OPML default (/Users/rogeryang/Downloads/follow.opml), running browser searches for Xiaohongshu, and using watchlist files for WeChat/XHS. The provided scripts only handle OPML parsing and RSS/Atom fetching/scoring — there is no code to perform browser searches, scrape WeChat/XHS, or integrate those watchlists. The default path may cause accidental exposure of local private feeds; the instructions also leave scraping/legal/credential details unspecified.
✓
Install Mechanism
No install spec or remote downloads; included code files are plain Python scripts with standard library usage (urllib, xml.etree). No third-party packages or external installers are pulled in.
✓
Credentials
The skill declares no required environment variables, credentials, or config paths. The scripts make outbound HTTP(S) requests to feed URLs but do not request secrets or access other system credentials.
✓
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It does not modify other skills or claim persistent system-wide privileges.
What to consider before installing
Before installing or running: (1) Note that the code only implements OPML->feeds parsing and RSS/Atom fetching + scoring — WeChat/Xiaohongshu scraping and 'browser search' are described but not implemented; expect manual steps or additional tooling if you need those sources. (2) The SKILL.md default OPML path points to a personal home directory; check and sanitize your OPML (assets/feeds.txt) so you don't leak private feed URLs. (3) The scripts make outbound HTTP requests to up to 20 feeds (default) — review the feed list for unwanted domains and be mindful of rate limits and scraping legality for non-RSS platforms. (4) If you need automated XHS/WeChat ingestion, ask the author for details or a concrete, auditable implementation (including how credentials/session cookies are handled); avoid running opaque browser automation. (5) Run the scripts in a sandboxed environment first and inspect outputs (and feed URLs) before integrating into daily automation.

Like a lobster shell, security has layers — review code before you run it.

latestvk975hnpgzt7b8qnrj5g1x00ns58206d5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments