Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agresource

v1.0.0

Scrapes and summarizes AgResource grain newsletters with daily sales advice, price-impact sentiment analysis, trend tracking, and Telegram alerts on updates.

0· 749·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for brianppetty/agresource.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Agresource" (brianppetty/agresource) from ClawHub.
Skill page: https://clawhub.ai/brianppetty/agresource
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agresource

ClawHub CLI

Package manager switcher

npx clawhub@latest install agresource
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill's name/description align with the code: it scrapes AgResource, analyzes sentiment, stores summaries, and (per SKILL.md) sends Telegram alerts. However, registry metadata lists no required environment variables while the code expects AGRESOURCE_EMAIL and AGRESOURCE_PASSWORD (and likely Telegram credentials). That mismatch is incoherent and should be corrected.
!
Instruction Scope
SKILL.md instructs the agent to log in to the AgResource dashboard using environment credentials, scrape pages with Playwright, save screenshots, and write multiple files under ~/clawd/memory/agresource. That scope is consistent with the stated purpose, but the instructions (and code) embed fallback credentials and write full newsletter content and screenshots to disk—sensitive actions that require explicit declaration and user consent.
Install Mechanism
There is no install spec (instruction-only install), which keeps risk lower in terms of arbitrary downloads. The code depends on Playwright/Node and Python; SKILL.md claims Playwright is available locally. Installing Playwright/Chromium can download large browser binaries, but no external or obfuscated download URL is present in the package itself.
!
Credentials
The code uses AGRESOURCE_EMAIL and AGRESOURCE_PASSWORD but the registry metadata didn't declare any required env vars or a primary credential—this is a mismatch. Worse, the JS files include plaintext fallback values (e.g., 'brianppetty@yahoo.com' and '4BrynnElizabeth'), which is a sensitive hard-coded credential leak. SKILL.md also promises Telegram alerts but no Telegram credential is declared in metadata; the skill may expect additional tokens (e.g., TELEGRAM_BOT_TOKEN, CHAT_ID) that are not surfaced.
Persistence & Privilege
always is false and the skill does not request system-wide changes; it writes files into a dedicated ~/clawd/memory/agresource directory which matches its purpose. It does not appear to modify other skills or global agent settings.
What to consider before installing
This skill's functionality (scraping AgResource, summarizing, sentiment tracking, saving files, sending Telegram alerts) is coherent, but there are important security and privacy issues you should address before installing: - Do not accept the skill as-is. The code includes hard-coded fallback credentials (email and password) in multiple JS files. Treat those as compromised: they should be removed and rotated if they are real. - The registry metadata does not declare required environment variables even though the skill expects AGRESOURCE_EMAIL and AGRESOURCE_PASSWORD (and likely Telegram tokens). Ask the author to declare required env vars explicitly (and avoid embedding defaults in code). - Verify where Telegram alerts are implemented and whether a bot token or chat ID is required; those credentials must be declared and scoped appropriately. - The skill uses Playwright to control a browser and will save screenshots and full newsletter content to ~/clawd/memory/agresource; confirm you are comfortable with that storage (it may contain subscription-protected content). Consider restricting file permissions or changing the storage path if needed. - Inspect the full code (particularly any omitted/truncated parts) for network calls beyond agresource.com (e.g., unexpected remote endpoints) before giving it access to your credentials. - If you plan to use the skill, require the author to remove embedded credentials, update registry metadata to list required env vars, and document what external services are contacted. If the embedded credentials are yours or someone you know, rotate them immediately. If you want, I can: (1) list the exact files/lines where hard-coded credentials appear, (2) search the remaining truncated code for Telegram/network endpoints, or (3) suggest a minimal safe configuration checklist to prepare before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk977vnc0mk23g2j2w5jqhnetw981eq3r
749downloads
0stars
1versions
Updated 14h ago
v1.0.0
MIT-0

AgResource Newsletter Scraper

Use this skill to scrape, summarize, and analyze AgResource grain marketing newsletters.

Implementation

  • Scraper: scraper.js (Playwright/Node.js)
  • Sentiment Analyzer: agresource_sentiment.py (Python)
  • Login: Automatic using AGRESOURCE_EMAIL and AGRESOURCE_PASSWORD env vars

Capabilities

  • Log in to AgResource dashboard (https://agresource.com/dashboard/#/reports/daily)
  • Scrape daily newsletter content using Playwright
  • Save screenshot for reference/debugging
  • Extract corn/soybean sales advice and recommendations
  • Generate concise summaries with key news and weather tidbits
  • Analyze sentiment (bullish/bearish) across newsletters
  • Compare to previous newsletters to detect trends
  • Store summaries in ~/clawd/memory/agresource/YYYY-MM-DD.md (morning)
  • Store summaries in ~/clawd/memory/agresource/YYYY-MM-DD-noon.md (noon)
  • Store summaries in ~/clawd/memory/agresource/YYYY-MM-DD-evening.md (evening)
  • Store summaries in ~/clawd/memory/agresource/YYYY-MM-DD-saturday.md (saturday)
  • Store summaries in ~/clawd/memory/agresource/YYYY-MM-DD-sunday.md (sunday)
  • Track sentiment history in ~/clawd/memory/agresource/sentiment_history.json
  • Send Telegram alerts on new sales advice

Commands

Manual Trigger

"Check AgResource newsletter"
"Summarize today's grain report"
"Show full newsletter" (detailed view)

To run scraper manually:

cd /home/brianppetty/clawd/skills/agresource

# Morning newsletter (default)
node scraper.js
node scraper.js --type=morning

# Noon/midday newsletter
node scraper.js --type=noon

# Evening newsletter
node scraper.js --type=evening

# Saturday newsletter
node scraper.js --type=saturday

# Sunday newsletter
node scraper.js --type=sunday

Cron Job Triggers

When a cron event fires, match the time/type to the correct --type parameter:

Cron MessageType to UseTime
"Check AgResource newsletter (morning)"--type=morning8:30 AM ET (Mon-Fri)
"Check AgResource newsletter (afternoon)"--type=noon1:30 PM ET (Mon-Fri)
"Check AgResource newsletter (evening - positioning)"--type=evening7:00 PM ET (Mon-Sat)
"Check AgResource newsletter (weekend)"--type=saturday or --type=sunday~3:00 PM ET (Sat/Sun)

For weekend jobs, determine which day it is and use:

  • Saturday: --type=saturday
  • Sunday: --type=sunday

Sentiment Queries

"What's the current market sentiment?"
"Show sentiment trends"
"What's the sentiment history?"

Sentiment Dimensions (PRICE-IMPACT FOCUSED)

CRITICAL: Sentiment analysis tracks PRICE IMPACT, not general "good/bad" news.

Key inverse relationships to remember:

  • ☀️ Favorable weather in SA/NA = More supply = BEARISH for prices
  • 🌽 Record yields = More supply = BEARISH for prices
  • 🏜️ Drought/crop stress = Less supply = BULLISH for prices
  • 🏭 Strong export demand = More demand = BULLISH for prices
  • 📦 South American competition = Less US exports = BEARISH for prices

Track these dimensions across newsletters:

  • market_mood: bullish | bearish | neutral
    • BULLISH = Prices expected to go UP
    • BEARISH = Prices expected to go DOWN
  • weather_impact: positive_for_crops | negative_for_crops | mixed | neutral
    • Tracks weather impact on PRODUCTION (inverted for price impact)
    • Positive weather for crops = BEARISH for prices (more supply)
    • Negative weather for crops = BULLISH for prices (less supply)
  • production_outlook: optimistic | cautious | uncertain
    • Optimistic = more supply = BEARISH for prices
    • Cautious = supply concerns = BULLISH for prices
  • trend_direction: improving | declining | stable
  • confidence: high | medium | low

Sales Advice Detection

Status phrases to detect:

  • "New sales advice detected" (buy/sell/recommend keywords)
  • "Catch up sales recommended" (catch up phrase)
  • "No sales recommended at this time" (hold/no action)
  • "Position status unchanged" (no change from previous)

Keywords for sales advice:

  • buy, sell, hold, recommend, recommendation, position, catch up, current positioning

Telegram Alert Format

Brief summary sent for every newsletter:

🌾 AgResource - 2026-01-08 8:30 AM

Summary: No sales recommended
Sentiment: Bullish (↗️ improving)

Full details in ~/clawd/memory/agresource/

Output Format

Daily Summary File (YYYY-MM-DD.md)

# AgResource Newsletter - 2026-01-08 8:30 AM

## Quick Summary
[2-3 sentence overview]

## Key Newsworthy Items
- [Grain production relevant news]
- [Weather tidbits]

## Sales Advice Status
- Corn: [New sales advice / No change / No sales recommended]
- Soybeans: [New sales advice / No change / No sales recommended]

## Current Positions (from end of newsletter)
- [Summary of current positioning]

## Sentiment & Trends
- **Market Mood:** Bullish / Bearish / Neutral
- **Previous Mood:** [from last newsletter]
- **Trend:** Improving / Declining / Stable
- **Weather Impact:** Positive / Negative / Mixed
- **Production Outlook:** Optimistic / Cautious / Uncertain

## Full Content
[Optional: full newsletter content for reference]

Sentiment History File (sentiment_history.json)

{
  "last_updated": "2026-01-08T08:30:00",
  "sentiment_history": [
    {
      "date": "2026-01-08",
      "time": "08:30 AM",
      "market_mood": "bullish",
      "weather_impact": "positive",
      "production_outlook": "optimistic",
      "trend_direction": "improving",
      "confidence": "high",
      "key_phrases": ["prices advancing", "favorable weather"],
      "sales_advice": "No sales recommended"
    }
  ]
}

Configuration

Credentials: Loaded from environment variables

  • AGRESOURCE_EMAIL
  • AGRESOURCE_PASSWORD

Dependencies:

  • Node.js (built-in on Clawdbot)
  • Playwright (installed locally: /home/brianppetty/clawd/skills/agresource/node_modules/playwright)

Schedule: 4x daily (cron jobs)

  • Morning: 8:30 AM ET
  • Afternoon: 1:30 PM ET
  • Evening: 7:00 PM ET
  • Weekend: ~3:00 PM ET

History window: Keep last 15-20 newsletters for sentiment tracking

Notes

  • Only send Telegram alerts when sales advice CHANGES
  • Always store summaries and sentiment data
  • Refine sentiment detection patterns over time
  • Evening newsletters include current positioning section
  • Login credentials should be handled securely

Comments

Loading comments...