Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FeedNest

v0.1.1

Aggregate and manage articles, highlights, notes, and tags from your personal trusted feeds, podcasts, and news sources with FeedNest integration.

0· 109·0 current·0 all-time
byLuca Iaconelli@lucaiaconelli

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lucaiaconelli/feednest.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FeedNest" (lucaiaconelli/feednest) from ClawHub.
Skill page: https://clawhub.ai/lucaiaconelli/feednest
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feednest

ClawHub CLI

Package manager switcher

npx clawhub@latest install feednest
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name and description match an aggregator for a user's feeds and the SKILL.md describes the exact plugin calls you'd expect (feednest_get_articles, highlights, tags, etc.). However, SKILL.md explicitly says a FeedNest Pro account and an API key are required and instructs installing @feednest/openclaw — yet the registry metadata lists no required env vars/primary credential and no install spec. The missing declaration of the API key (or how credentials are supplied) is inconsistent with the stated purpose.
!
Instruction Scope
The instructions stay within the FeedNest domain (listing calls, urging to confirm before bulk actions, and forbidding external summarization APIs). But the document is truncated at the end and instructs installing an external plugin via `openclaw plugins install @feednest/openclaw`. That CLI instruction implies fetching and executing third-party code; the SKILL.md does not state how credentials are provided to the plugin or whether the agent should prompt the user, which is an operational gap and risk (agent might try to access unspecified env vars or request the key).
Install Mechanism
This skill is instruction-only (no install spec in registry), which is lower risk. However, SKILL.md tells the user/agent to install an external OpenClaw plugin (@feednest/openclaw). Because the registry didn't include an install spec or a homepage/repo URL, the provenance of that plugin is unknown — installing third-party plugins can pull arbitrary code. This is a traceability/provenance concern, not necessarily malicious.
!
Credentials
SKILL.md requires a FeedNest Pro account and an API key from FeedNest's Developer API, but the registry metadata lists no required environment variables or primary credential. The skill does not specify the exact env var name or auth mechanism. Requiring an API key is reasonable for this purpose, but the omission from metadata and lack of clarity about where/how the key is stored or used is disproportionate and risky (could lead to accidental sharing or misconfiguration).
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. Model invocation is allowed (normal). There is no evidence it modifies other skills or system-wide settings.
What to consider before installing
This skill appears to implement a FeedNest integration, but before installing or providing credentials: 1) Verify the provenance of the @feednest/openclaw plugin (repository URL, publisher identity, and code review). 2) Ask the publisher how the FeedNest API key should be provided (exact env var name, OpenClaw plugin auth flow, or prompt) and confirm it will not be exfiltrated to unknown endpoints. 3) Do not paste your FeedNest API key into chat; provide it only through the platform's secure credential mechanism after verifying the plugin. 4) If you can't verify the plugin source or the missing metadata is not corrected (registry should list required credentials and an install spec/repo), consider treating this as untrusted and avoid installing.

Like a lobster shell, security has layers — review code before you run it.

aivk979c0gwa113hes89ewcyfk2nx83bvs8audiovk979c0gwa113hes89ewcyfk2nx83bvs8feedsvk979c0gwa113hes89ewcyfk2nx83bvs8highlightsvk979c0gwa113hes89ewcyfk2nx83bvs8latestvk979c0gwa113hes89ewcyfk2nx83bvs8newsvk979c0gwa113hes89ewcyfk2nx83bvs8notesvk979c0gwa113hes89ewcyfk2nx83bvs8readingvk979c0gwa113hes89ewcyfk2nx83bvs8rssvk979c0gwa113hes89ewcyfk2nx83bvs8
109downloads
0stars
1versions
Updated 1mo ago
v0.1.1
MIT-0

FeedNest - Your Sources, Not the Whole Web

ChatGPT searches the internet. Perplexity crawls billions of pages. FeedNest is different. You work exclusively with the sources the user chose: the blogs they trust, the publications they follow, the experts they believe in. No algorithmic noise. No black-box results. Intelligence grounded in their world.

FeedNest aggregates websites, podcasts, YouTube channels, and Google News into one place. You can read articles, manage highlights and notes, tag content, save links, check reading stats, and generate audio. Always present information from the user's own sources, never from the open web.

Requirements

This skill requires the FeedNest plugin. Install it first:

openclaw plugins install @feednest/openclaw

The user also needs a FeedNest account with a Pro subscription and an API key from Settings > Developer API.

When to Use Each Tool

Reading Articles

IntentToolKey Params
"What's new?"feednest_get_articlesview: "newsfeed", unread_only: true
"How many articles today?"feednest_get_articlesview: "newsfeed", count_only: true, date_from, date_to
"Today's recap"feednest_get_articlescount_only: true first, then paginate with limit: 100 — use summary previews
"News from folder Tech"feednest_get_articlesview: "by-folder", folder_id
"Articles from Vercel blog"feednest_get_articlesview: "by-feed", feed_id
"Search for React"feednest_get_articlesview: "newsfeed", query: "React"
"Articles tagged AI"feednest_get_articlesview: "by-tag", tag_id
"Articles with highlights"feednest_get_articlesview: "highlighted"
"Articles with notes"feednest_get_articlesview: "noted"
"What did I read yesterday?"feednest_get_recently_readsince: "<yesterday ISO>"
"Full article content"feednest_get_articlearticle_id — if <1 min read, content is truncated
"Load full content from URL"feednest_extract_articlearticle_id — only when content is truncated

Managing Read Status

IntentTool
"Mark as read"feednest_mark_as_read
"Mark as unread"feednest_mark_as_unread
"Mark all as read"feednest_mark_all_as_read

Saving

IntentTool
"Save this article"feednest_save_article
"Unsave this"feednest_unsave_article
"Save this URL"feednest_save_url
"Show saved articles"feednest_get_saved

Highlights

IntentTool
"What did I highlight?"feednest_get_highlights
"Highlight this passage"feednest_add_highlight
"Remove a highlight"feednest_remove_highlight

Notes

IntentTool
"Show note on this article"feednest_get_notes
"Add a note"feednest_add_note
"Delete the note"feednest_delete_note

Tags

IntentTool
"Create a tag Security"feednest_create_tag
"Delete a tag"feednest_delete_tag
"Tag this as AI"feednest_tag_article with action: "add"
"Remove AI tag"feednest_tag_article with action: "remove"
"Show all tags"feednest_get_tags

Organization & Info

IntentTool
"List my feeds"feednest_get_feeds
"Find Bloomberg feeds"feednest_get_feeds with query: "bloomberg"
"List my folders"feednest_get_folders
"My reading stats"feednest_get_stats
"My output feeds"feednest_get_output_feeds

AI

IntentTool
"Read this article aloud"feednest_text_to_speech

Best Practices

  1. Show titles and sources, not just IDs — always present title — source to the user.
  2. Ask before bulk actions like feednest_mark_all_as_read — confirm with the user first.
  3. Summarize and translate directly from article content. Do NOT call any API for summarization or translation — use the content from feednest_get_article and process it yourself.
  4. Group articles by source when presenting many results.
  5. Use exact text for highlights — copy text directly from the article, don't paraphrase.
  6. Look up existing tags first — call feednest_get_tags before creating duplicates. Only use feednest_create_tag if the tag doesn't exist.
  7. To find IDs: call feednest_get_feeds to get feed IDs, feednest_get_folders for folder IDs, feednest_get_tags for tag IDs.

Boundaries

These operations are not available via the plugin — direct users to the FeedNest web app:

  • Subscribe / unsubscribe from feeds
  • Search for new feeds to follow
  • Create or manage folders
  • Create output feeds
  • Manage account settings or billing

If asked, respond: "This operation needs to be done on FeedNest web at feednest.com."

Conversation Examples

Daily recap / brief:

  1. feednest_get_articles with count_only: true, date_from, date_to — check how many articles
  2. Paginate with limit: 100 using before_published_at + before_id cursors
  3. Use the summary_preview field (~200 chars) to produce the recap — no need to read each article
  4. Group by source/topic when presenting results
  5. Only call feednest_get_article for articles the user specifically wants to read in full

Read an article (handle truncated RSS):

  1. feednest_get_article — get content
  2. If reading time is <1 min, content is likely truncated by the RSS feed
  3. Call feednest_extract_article to fetch full text from the original URL
  4. Do NOT extract every article — only truncated ones

Auto-tagging workflow:

  1. feednest_get_articles (unread, limit 20) — get today's articles
  2. For each article: analyze the title/content
  3. feednest_get_tags — check existing tags
  4. If needed: feednest_create_tag — create missing tags
  5. feednest_tag_article with action: "add" — apply tags

Highlight key passages:

  1. feednest_get_article — get full content
  2. Analyze and identify key passages
  3. feednest_add_highlight for each important passage (use exact article text, not paraphrased)

Comments

Loading comments...