Attention Research Pipeline

Scheduled intelligence research pipeline — monitors topics on a twice-daily cadence, produces signal-first digests, maintains META.json freshness state. Use...

Security Scan

The skill's code and instructions mostly match a scheduled research/digest pipeline, but there are inconsistencies around installation metadata and secret handling that you should review before installing.

Purpose & Capability

The name/description (scheduled topic monitoring, digests, META.json freshness) align with the files and scripts included (prompts, CONFIG, install script, cron setup, executor). Requiring python3 and openclaw is expected. Delivery via Telegram/WhatsApp is also consistent with the described capability. However, the declared install metadata is inconsistent (shows a 'node' installer for 'python3'), which does not match the actual requirement and looks like a packaging/manifest error.

Instruction Scope

SKILL.md instructs the agent to use the agent's web search tool, read PROMPTS/TOPICS/*.md, write news files and META.json under $HOME/.openclaw/workspace/docs/research, and deliver digests via Telegram/WhatsApp. Those actions are within the stated purpose. The runtime instructions do not ask for arbitrary system file reads beyond the research root or for unrelated credentials. The agent will perform network searches and deliver messages (expected).

Install Mechanism

The package recommends cloning from GitHub (standard) and runs INSTALL/install.sh which installs PyYAML via pip if missing. The pip call uses --break-system-packages (this may alter or bypass system package protections on some systems). The SKILL.md/metadata contains an odd install entry: 'kind: node' with 'package: python3' (a mismatch). The repository itself is hosted on GitHub (expected), not a private/personal raw server, which reduces but does not eliminate risk. You should inspect SCRIPTS/setup-cron.sh and SCRIPTS/research-executor.sh before running the installer.

Credentials

The manifest declares no required environment variables, but the skill expects delivery credentials (Telegram bot_token, chat_id or WhatsApp recipient) to be provided in CONFIG/.secrets.yaml or configured via the agent at onboarding. Those delivery secrets are necessary to operate but are not declared in the skill's 'requires' metadata. This mismatch could lead to secret configuration confusion; verify where you must place tokens and avoid committing them to repo. No other unrelated credentials are requested.

Persistence & Privilege

The skill registers cron jobs and writes state under ~/.openclaw/workspace/docs/research and ~/.openclaw/cron (via setup scripts), which is necessary for scheduled operation. 'always' is false. Autonomous scheduled runs (cron) are the intended behavior; because the skill will run periodically and can perform web searches and send messages, confirm you want that background activity and the delivery target before activation.

What to consider before installing

What to check before installing: - Inspect the two script files (SCRIPTS/setup-cron.sh and SCRIPTS/research-executor.sh) to confirm they only register cron jobs and run the research executor, and that they do not call unexpected external endpoints or read unrelated files. Do not run the installer until you review them. - Note that delivery secrets (Telegram bot token, chat_id or WhatsApp recipient) are expected to be provided by you (CONFIG/.secrets.yaml or agent prompts). The skill did not declare these env vars in its manifest — confirm where to store tokens and never commit secrets to the repo. - The installer will attempt to pip install PyYAML and uses --break-system-packages; consider running in a virtualenv or isolated environment to avoid altering system Python packages. - The SKILL.md metadata contains an odd install spec ('kind: node' for 'python3'). Treat that as a packaging/manifest error — it does not itself indicate malicious intent but pay attention to the actual install steps in INSTALL/install.sh. - Because the skill registers cron jobs that will run automatically and send messages, create a dedicated Telegram bot/chat or WhatsApp recipient with minimal privileges (do not use sensitive admin accounts) for digest delivery. - If you want higher assurance, run the install and cron scripts in a sandboxed environment or container first, or disable automatic cron registration and run the executor manually to observe behavior. Given these inconsistencies (manifest/install metadata and undeclared delivery secrets), proceed only after manual review of the scripts and a plan for sandboxed deployment or least-privilege delivery credentials.

attention-research Skill

Scheduled intelligence research pipeline with topic monitoring, freshness state, signal-first digest delivery, and per-topic alerting based on topic-defined threshold criteria.

What It Is

A twice-daily research cadence (morning + afternoon) that:

• Scans configured topics via the agent's web search tool
• Maintains per-topic freshness state in META.json
• Uses each PROMPTS/TOPICS/<topic>.md file as the standing monitoring note for that topic
• Produces digests that connect signals, not just dump headlines
• Alerts the user when key events or threshold criteria defined by the topic are met
• Delivers via Telegram or WhatsApp

Core Concepts

Topic

A long-running monitoring domain (e.g., us-iran-conflict, ai, geopolitics).

Topic Monitoring Note

PROMPTS/TOPICS/<topic>.md is not just setup text. It is the standing monitoring note for that topic. It should contain the topic's methodology, analysis framework, entity framing, signal criteria, watch items, and threshold/key event logic used to decide when the user should be alerted.

Thread

An active research question within a topic. Threads have state, typed connections, and delta updates.

Digest

The default output surface. A structured readout of what changed and why.

META.json Freshness Contract

Every topic has a META.json that acts as a shared freshness marker for all writers:

• Morning and afternoon slots have independent timestamps
• Max 2 retries per topic per day total
• After 2 failures → topic skipped for that day

Research Root

$HOME/.openclaw/workspace/docs/research/

Package Structure

attention-research/
├── PROMPTS/
│   ├── CORE/                    # Generic analysis framework shared across topics
│   │   ├── system-prompt.md
│   │   ├── signal-rules.md
│   │   └── digest-format.md
│   ├── TOPICS/                  # Topic-local methodology and monitoring notes
│   │   ├── us-iran-conflict.md
│   │   ├── ai.md
│   │   ├── geopolitics.md
│   │   ├── finance-markets.md
│   │   ├── climate-changes.md
│   │   └── bio-tech.md
│   ├── TEMPLATES/
│   │   ├── morning-research.md
│   │   ├── afternoon-research.md
│   │   └── onboarding.md
│   └── GENERATOR/
│       └── generator.md
├── CONFIG/
│   ├── topics.yaml
│   └── default-paths.yaml
├── SCHEMA/
│   └── META.json.template
├── SCRIPTS/
│   ├── research-executor.sh
│   └── setup-cron.sh
├── INSTALL/
│   └── install.sh
├── SKILL.md
├── README.md
└── package.json

Installation

# Install via clawhub (after publishing)
clawhub install attention-research

# Or install directly from GitHub with git
mkdir -p ~/.openclaw/skills
git clone https://github.com/riverho/attention-research.git ~/.openclaw/skills/attention-research
cd ~/.openclaw/skills/attention-research
bash INSTALL/install.sh --fresh

# Or install directly from GitHub with curl
mkdir -p ~/.openclaw/skills && \
cd ~/.openclaw/skills && \
curl -L https://github.com/riverho/attention-research/archive/refs/heads/master.tar.gz \
  | tar -xz && \
mv attention-research-master attention-research && \
cd attention-research && \
bash INSTALL/install.sh --fresh

Configuration

Agent onboarding contract

Any agent using this skill should follow this order:

1. Install the repo or skill files
2. Ask the user to confirm the default research root:
   • preferred: ~/.openclaw/workspace/docs/research
   • fallback: ~/docs/research
3. Check delivery configuration (Telegram chat ID or WhatsApp recipient)
4. Present the default OSS topic set:
   • us-iran-conflict
   • ai
   • finance-markets
5. For each selected topic, read PROMPTS/TOPICS/<topic>.md and extract the key entities / entity framework back to the user before activation
6. Ask whether to activate the topic
7. Ask whether to register the morning and afternoon cron jobs
8. Only after approval: update config, run setup, and activate monitoring

topics.yaml — What to Track

topics:
  us-iran-conflict:
    display_name: "US-Iran Conflict"
    description: "US-Iran tensions, Hormuz, nuclear talks, sanctions"
    enabled: true
    search_query: "US Iran conflict Hormuz nuclear talks"

Delivery Channel

Edit CONFIG/default-paths.yaml:

delivery:
  telegram:
    chat_id: "YOUR_CHAT_ID"

Cron Jobs

Job	Schedule	Purpose
AR morning digest	08:00 HKT	Morning research scan
AR afternoon update	16:00 HKT	Afternoon research scan

Publishing

clawhub publish ./attention-research \
  --slug attention-research \
  --name "Attention Research Pipeline" \
  --version 1.0.0 \
  --changelog "First public OSS cut"

Requirements

• Python 3 + PyYAML
• OpenClaw with cron daemon
• A web search tool available to the agent (agent-chosen: Tavily, Brave, native, etc.)
• Telegram or WhatsApp delivery channel

Agent operating rule

Agents should treat this skill as an attention-research workflow, not just a folder of prompts.

On every run:

• follow the prompt stack order
• read PROMPTS/TOPICS/<topic>.md as the live monitoring note for that topic
• use the topic's own methodology and key-event criteria to judge significance
• keep runtime artifacts isolated per topic under the research root
• alert the user when threshold or key-event criteria in the topic file is met
• do not let one topic's analysis framework bleed into another topic's reasoning