daily-news-english-cards

Generate daily bilingual English learning cards with vocabulary, summaries, and AI-created comic illustrations from the latest news in politics, finance, spo...

Security Scan

The skill mostly does what it says (fetch news, generate text and images), but the included script reads arbitrary .env files and auto-installs packages at runtime — behaviors that increase the chance of accidental secret exposure or unexpected system changes.

Purpose & Capability

Name/description align with required APIs and the bundled script: Tavily for news, DeepSeek for text-generation, OpenRouter for images. Required packages in requirements.txt and SKILL.md match the stated functionality.

Instruction Scope

SKILL.md instructs to set three API keys and run the generator script, which is consistent. However, the script's _load_dotenv() will search for and load a .env file from the script parent directories and the current working directory and inject any key=value pairs into the environment if the key is not already set. That means it may read unrelated secrets from the user's filesystem (e.g., other tokens in a repo-level .env). The SKILL.md does not warn about this behavior.

Install Mechanism

There is no formal install spec, but the script auto-installs missing Python packages via subprocess.check_call([sys.executable, '-m', 'pip', 'install', ...]) at runtime. Auto-installing packages without an explicit install step can modify the environment unexpectedly and pulls code from package indexes at runtime. The packages themselves are common (tavily-python, openai, Pillow, requests), but runtime pip installs raise risk and surprise.

Credentials

The three required environment variables (TAVILY_API_KEY, DEEPSEEK_API_KEY, OPENROUTER_API_KEY) are appropriate for the stated services. However, because the script will load .env files and populate os.environ for any keys found, it can introduce additional environment variables that were not declared or intended by the skill. That increases the attack surface if sensitive keys exist in those files.

Persistence & Privilege

The skill is not always-enabled and does not declare persistent elevated privileges. It writes outputs to an output/ directory and caches fonts under ~/.cache/news-cards-fonts, which is reasonable for a generator script. It does not modify other skills' configs.

What to consider before installing

This skill appears to implement its advertised functionality, but exercise caution before running it. Key considerations: - Review the generate_cards.py source yourself (it was included) and confirm you trust calls to external APIs (Tavily, DeepSeek, OpenRouter). - The script will auto-install missing Python packages at runtime; run it in a controlled environment (virtualenv, container) so installs don't affect your system Python. - The script auto-loads a .env file from parent folders or the cwd and injects any key=value pairs into the environment if not already set. That can cause unrelated secrets to be used unintentionally — inspect any .env files in the repository tree before running, or delete/rename them. - Provide only the API keys required for the services; avoid placing other sensitive credentials in .env files accessible to this script. - If you want lower risk, set the three required env vars explicitly and run the script in an isolated environment; consider removing or modifying the .env-loading behavior before use. If you want, I can point to the exact lines that implement .env loading and runtime pip installs so you can patch or sandbox them.

Generate daily news English learning cards with comic illustrations.

Search the latest 24-hour news across 5 categories (Politics, Finance, Sports, Entertainment, Technology), create vocabulary-rich learning cards with AI-generated comic art and bilingual summaries.

Use when the user asks to "generate English learning cards", "create news cards", "daily English cards", "新闻英语卡片", "每日英语学习", "生成学习卡片", or similar requests related to news-based English learning content.

---

Prerequisites

Three API keys are required. Set them as environment variables before running:

Variable	Service	Get Key
TAVILY_API_KEY	Tavily Search (news)	https://tavily.com
DEEPSEEK_API_KEY	DeepSeek (text gen)	https://platform.deepseek.com
OPENROUTER_API_KEY	OpenRouter (image gen)	https://openrouter.ai

Optional:

Variable	Default	Description
IMAGE_MODEL	google/gemini-3.1-flash-image-preview	OpenRouter image model (Nano Banana 2)

Steps

1. Verify environment variables are set

   Check that TAVILY_API_KEY, DEEPSEEK_API_KEY, and OPENROUTER_API_KEY are configured. If any are missing, prompt the user to set them.

2. Install dependencies

   pip install -q tavily-python openai Pillow requests
   

3. Run the generator script

   python daily-news-english-cards/scripts/generate_cards.py
   

   The script will:

   • Search 5 categories of news via Tavily
   • Generate vocabulary & summaries via DeepSeek
   • Create comic illustrations via OpenRouter (Nano Banana 2)
   • Composite final learning cards via Pillow

4. Present results

   Show the user the generated card images from output/daily-news-cards/{date}/.

Customization

# Custom categories
python daily-news-english-cards/scripts/generate_cards.py --categories politics sports technology

# Custom output directory
python daily-news-english-cards/scripts/generate_cards.py --output-dir ./my-cards

Output

Each run produces in output/daily-news-cards/{date}/:

• card_{category}_{date}.png — Final learning cards (1080×1440px)
• comic_{category}_{date}.png — Raw comic illustrations
• content_{date}.json — Structured learning content data

Architecture

daily-news-english-cards/
├── SKILL.md                    # This file
├── requirements.txt            # Python dependencies
└── scripts/
    └── generate_cards.py       # Self-contained generator (all logic in one file)

The script is fully portable — works with Cursor, OpenClaw, or standalone CLI. No IDE-specific tools are used; all external calls go through standard APIs.