Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AI资讯网站生成器

v1.0.0

AI资讯网站生成器 - 一键构建智能内容聚合平台

0· 79·0 current·0 all-time
byninetyhe@ninetyhe-90

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ninetyhe-90/ai-news-website-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "AI资讯网站生成器" (ninetyhe-90/ai-news-website-generator) from ClawHub.
Skill page: https://clawhub.ai/ninetyhe-90/ai-news-website-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ai-news-website-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install ai-news-website-generator
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md, and provided code (FastAPI backend + Next.js frontend templates) align with an RSS news site generator — generating a project, scheduling refreshes, and serving APIs is expected. However, the generator script references template Dockerfiles (backend-Dockerfile, frontend-Dockerfile) that are not present in the template manifest; the skill claims Docker support and 'one‑click' Docker deployment but required Dockerfile templates are missing, which is inconsistent.
!
Instruction Scope
Runtime instructions tell the agent/user to run the included generate-project.py and then docker-compose up. The included backend/main.py fetches external RSS feeds (expected). But the instructions assume Dockerfiles and a working docker-compose build; given missing Dockerfile templates, following the instructions will likely fail. The backend enables CORS for all origins (allow_origins=['*']), which is common for public APIs but worth noting. No instructions or code attempt to read unrelated system files or require secrets.
Install Mechanism
There is no install spec (instruction-only skill + code templates), so nothing will be silently downloaded at install time. Files are present inside the skill bundle; no external arbitrary downloads occur during generation. This is low installer risk, but the bundle is incomplete.
Credentials
The skill declares no required environment variables, credentials, or config paths. The code similarly does not require secrets — it only fetches public RSS feeds. This is proportionate to its stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request elevated/persistent privileges. It does schedule periodic work inside the generated project (APScheduler), but that affects only the generated project runtime, not the agent or host system beyond normal service execution.
What to consider before installing
This skill appears to implement an RSS-based news site generator and does not request secrets or contain obvious exfiltration code, but the package is sloppy and likely broken for the advertised 'one‑click Docker' workflow. Before using: 1) Inspect the template folder locally — note that Dockerfile templates referenced by scripts are missing; you will likely need to add proper frontend/backend Dockerfiles before using docker-compose. 2) Run the generator and builds in an isolated/dev environment (container or VM) the first time. 3) If deploying to production, replace the in-memory articles store with a real DB, restrict CORS, and add proper error handling and input validation. 4) If you are not comfortable debugging missing files, avoid running scripts from this unknown source or request a corrected/complete package from the author.
templates/frontend-page.tsx:26
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ac557htx8g72q9p7x3r32k984qc3n
79downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

AI资讯网站生成器

一键生成完整的AI资讯聚合网站!包含Next.js前端、FastAPI后端、Docker容器化部署、以及自动定时刷新功能。不仅适用于AI新闻,也适用于任何RSS源的内容聚合。

核心特性

  • 一键生成 - 完整的项目结构,开箱即用
  • 多源RSS聚合 - 支持配置任意RSS源
  • 自动去重 - 基于内容哈希的智能去重
  • 定时刷新 - 内置APScheduler,可配置刷新间隔
  • Docker部署 - 一键启动,跨平台兼容
  • 响应式设计 - 支持移动端和桌面端
  • 分类筛选 - 按来源和类别筛选内容
  • 无限滚动 - 流畅的浏览体验

技术栈

层级技术选型
前端Next.js 15 + React 19 + TypeScript + Tailwind CSS
后端Python + FastAPI + feedparser + APScheduler
部署Docker + Docker Compose

快速开始

1. 生成项目(30秒搞定!)

# 运行项目生成脚本
python ~/.hermes/skills/productivity/ai-news-website-generator/scripts/generate-project.py

# 或者指定项目目录
python ~/.hermes/skills/productivity/ai-news-website-generator/scripts/generate-project.py my-news-site

脚本会自动创建完整的项目结构,包含:

  • ✅ Next.js 前端(带漂亮的深色主题)
  • ✅ FastAPI 后端(含自动刷新)
  • ✅ Docker 配置(一键部署)
  • ✅ 启动脚本(本地/Docker双模式)

2. 配置RSS源

编辑 backend/main.py 中的 RSS_FEEDS

RSS_FEEDS = [
    {"name": "OpenAI Blog", "url": "https://openai.com/blog/rss.xml", "category": "AI"},
    {"name": "你的RSS源", "url": "https://example.com/rss.xml", "category": "科技"},
]

3. 启动项目

cd ai-news-website
docker-compose up -d

4. 访问网站

项目结构

ai-news-website/
├── frontend/                 # Next.js 前端
│   ├── app/
│   │   ├── page.tsx         # 首页
│   │   ├── layout.tsx       # 布局
│   │   └── globals.css      # 全局样式
│   ├── components/
│   │   ├── NewsList.tsx     # 新闻列表
│   │   └── NewsCard.tsx     # 新闻卡片
│   ├── Dockerfile
│   └── package.json
├── backend/                  # FastAPI 后端
│   ├── main.py              # 主应用(含定时任务)
│   ├── requirements.txt
│   └── Dockerfile
├── docker-compose.yml        # Docker编排
├── start.sh                  # 一键启动脚本
├── README.md                 # 详细文档
└── PROJECT_SUMMARY.md        # 项目总结

自定义配置

修改刷新频率

编辑 backend/main.py

# 每6小时刷新
scheduler.add_job(refresh_articles, 'interval', hours=6, id='refresh_rss')

# 改为每小时刷新
scheduler.add_job(refresh_articles, 'interval', hours=1, id='refresh_rss')

# 改为每30分钟刷新
scheduler.add_job(refresh_articles, 'interval', minutes=30, id='refresh_rss')

修改端口

编辑 docker-compose.yml

services:
  frontend:
    ports:
      - "3000:3000"  # 改为 "8080:3000"
  
  backend:
    ports:
      - "8000:8000"  # 改为 "8081:8000"

API接口

方法路径说明
GET/api/articles获取文章列表
GET/api/articles/{id}获取单篇文章
POST/api/refresh手动刷新所有RSS源
GET/api/health健康检查

查询参数

GET /api/articles?page=1&limit=20&source=OpenAI&category=AI

使用场景

1. AI资讯门户网站

配置AI相关的RSS源(OpenAI、Google AI、MIT AI等),快速搭建AI资讯门户。

2. 技术博客聚合

聚合你喜欢的技术博客,打造个人技术阅读中心。

3. 行业资讯平台

为特定行业(区块链、生物医药、金融科技等)聚合专业资讯。

4. 团队知识门户

聚合团队内部博客和外部行业资讯,作为团队知识库。

部署建议

生产环境部署

  1. 使用Nginx反向代理
server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://localhost:3000;
    }

    location /api {
        proxy_pass http://localhost:8000;
    }
}
  1. 配置HTTPS(Let's Encrypt)
certbot --nginx -d your-domain.com
  1. 数据持久化

当前版本使用内存存储,生产环境建议:

  • 添加SQLite/PostgreSQL数据库
  • 使用Redis缓存
  • 添加文章搜索功能

扩展功能建议

第二阶段功能

  • 用户账户系统
  • 文章收藏和点赞
  • 邮件订阅推送
  • 社交媒体分享
  • 文章搜索功能

第三阶段功能

  • 个性化推荐
  • AI摘要生成
  • 多语言支持
  • 数据分析面板
  • 移动端App

实战案例

案例:创建区块链资讯站

  1. 配置区块链相关RSS源
  2. 修改前端主题色为区块链风格
  3. 部署到服务器
  4. 配置域名和HTTPS
  5. 启动!

案例:团队内部技术周报

  1. 配置团队博客和技术媒体RSS
  2. 每周一定期刷新
  3. 团队成员通过内网访问
  4. 作为每周技术分享的素材库

常见问题

Q: 如何添加更多RSS源?

A: 编辑 backend/main.py 中的 RSS_FEEDS 列表,添加新的源即可。

Q: 刷新失败怎么办?

A: 检查网络连接,确认RSS源URL可访问。查看后端日志:docker-compose logs backend

Q: 如何修改前端样式?

A: 编辑 frontend/app/globals.css 和组件文件,使用Tailwind CSS类。

Q: 可以不使用Docker吗?

A: 可以!使用 start.sh 脚本选择本地启动模式,或参考README中的手动启动步骤。

商业价值

作为SaaS服务

  • 提供在线网站生成器,按站点数收费
  • 提供托管服务,按月订阅
  • 提供高级功能(自定义域名、数据分析等)

作为技术解决方案

  • 为企业定制内部资讯门户
  • 为媒体客户提供内容聚合方案
  • 作为开发者工具包销售

开源社区价值

  • 成为热门开源项目
  • 建立开发者社区
  • 吸引贡献者共同维护

相关资源

许可证

MIT License - 可自由使用、修改和分发。


使用此Skill,你可以在5分钟内从0到1搭建一个专业的资讯聚合网站! 🚀

Comments

Loading comments...