Hacker News Daily Summary (Bilingual)

Fetches top 10 Hacker News stories, translates titles to Chinese via Baidu API, generates a bilingual Markdown report, and optionally sends to Feishu.

Security Scan

The skill does what it says: it fetches Hacker News top stories, translates titles via Baidu Translate, writes a Markdown report, and optionally posts to a Feishu webhook — the required credentials and network calls match that purpose.

Purpose & Capability

Name/description align with the provided script and SKILL.md: the script fetches HN topstories, calls Baidu Translate, generates ~/daily-news.md, and optionally posts to a Feishu webhook. The external endpoints used (hacker-news.firebaseio.com, fanyi-api.baidu.com, and the FEISHU_WEBHOOK) are consistent with the stated functionality. One minor incoherence: the top-level registry metadata in the report initially listed no required env vars, but clawhub.json and the script do require BAIDU_APPID and BAIDU_SECRET (and optionally FEISHU_WEBHOOK).

Instruction Scope

SKILL.md and daily-news.sh restrict actions to fetching HN items, calling Baidu Translate, writing a Markdown file in the user's HOME, and optionally POSTing to the provided Feishu webhook. There are no instructions to read unrelated files, search system state, or exfiltrate arbitrary data. The SKILL.md snippet appears to have a truncated/unterminated code block for the export example, but that is a documentation issue rather than malicious behavior.

Install Mechanism

No install spec is present (instruction-only plus a shell script). Nothing is downloaded or executed automatically at install time; the script runs only when executed by the user/agent. This is the lower-risk pattern for skills.

Credentials

The script legitimately needs BAIDU_APPID and BAIDU_SECRET to call Baidu Translate and optionally FEISHU_WEBHOOK to post to Feishu. These are proportionate to the stated purpose. Note that BAIDU_SECRET is sensitive (API secret) and will be sent to Baidu's translation API; only provide it if you trust the service and intend to use the feature. clawhub.json correctly lists these env vars even though the registry summary at the top omitted them.

Persistence & Privilege

The skill does not request always:true or any elevated platform privileges. It writes a single output file in the user's home directory and does not modify other skills or system-wide agent settings.

Assessment

This skill appears to be what it claims. Before installing/running: (1) Verify you are comfortable providing BAIDU_APPID and BAIDU_SECRET — those go to Baidu's translation API and are sensitive. Use a limited-scope/test key if possible. (2) If you will enable Feishu push, confirm the FEISHU_WEBHOOK value points to a webhook you control; anyone with that URL can post to the group. (3) Inspect daily-news.sh yourself (it's included) and run it in a safe environment the first time. (4) Note the SKILL.md documentation has a small formatting/truncation issue — ensure you export env vars correctly in your shell before running. (5) If you need to avoid external network calls, do not set the credentials or run the script.

Hacker News 每日新闻汇总（英中双语 + 飞书推送）

Version: 1.0.1

简介

自动抓取 Hacker News 前 10 条新闻，使用百度翻译 API 生成中文标题，并可选择推送到飞书群。

功能

• 获取 Hacker News 实时热门新闻
• 英中双语标题（百度翻译）
• 生成 Markdown 格式报告：~/daily-news.md
• 可选飞书机器人推送

依赖

• bash、curl、jq、md5sum（通常已安装）
• 百度翻译 API（免费，每月 100 万字符）
• 飞书自定义机器人（可选）

安装步骤

1. 获取百度翻译 API 密钥

• 访问 百度翻译开放平台
• 注册/登录，申请通用翻译 API（免费版）
• 记录 App ID 和 密钥

2. 创建飞书机器人（可选）

• 在飞书群中添加“自定义机器人”
• 复制 Webhook URL

3. 设置环境变量

将以下内容添加到 ~/.bashrc 或执行脚本前 export：

export BAIDU_APPID="你的AppID"
export BAIDU_SECRET="你的密钥"
export FEISHU_WEBHOOK="你的飞书Webhook地址"   # 若不需推送可留空或不设置