Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

News Summary

v1.0.1

This skill should be used when the user asks for news updates, daily briefings, or what's happening in the world. Fetches news from trusted international RSS...

0· 182·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nicenasa/hami-news-summary.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "News Summary" (nicenasa/hami-news-summary) from ClawHub.
Skill page: https://clawhub.ai/nicenasa/hami-news-summary
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install hami-news-summary

ClawHub CLI

Package manager switcher

npx clawhub@latest install hami-news-summary
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description (news summaries from RSS, optional voice) align with the provided curl commands and parsing steps. The listed RSS endpoints (BBC, Reuters, NPR, Al Jazeera) are consistent with a news-summary purpose.
!
Instruction Scope
The SKILL.md explicitly instructs the agent to call external RSS endpoints and to call OpenAI's TTS endpoint using $OPENAI_API_KEY. The skill's declared surface does not list any required env vars, but the instructions rely on an API key and network access. The SKILL.md also writes an audio file to /tmp/news.mp3 — benign for temporary output but something to note. Overall, the instructions reference credentials and external endpoints not declared in the metadata.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is written to disk by an installer. This is low-risk from an install-mechanism perspective.
!
Credentials
SKILL.md uses the environment variable $OPENAI_API_KEY for text→speech, but requires.env/primary credential fields declare no credentials. Requesting no credentials in metadata while instructing use of a secret is an incoherence and could lead to unexpected API key use or fail at runtime.
Persistence & Privilege
The skill is not always: true and is user-invocable; it does not request persistent privileges or claim to modify other skills or system-wide config.
What to consider before installing
What to check before installing: - Ask the publisher to clarify the missing credential declaration. The SKILL.md calls OpenAI's TTS endpoint using $OPENAI_API_KEY but the skill metadata lists no required environment variables — verify whether the skill will actually require and use your OpenAI API key. If you provide a key, the skill will send the news text to OpenAI for TTS (i.e., external transmission of generated content). - Verify the author/owner: _meta.json contains a different ownerId than the registry metadata shown in the package summary. That mismatch could be benign (packaging error) but is worth confirming. - Network access: the skill will make outbound requests to the listed RSS feeds (BBC, Reuters, NPR, Al Jazeera). Ensure you are comfortable with those external requests and with any data sent to OpenAI for TTS. - File writes: the example writes /tmp/news.mp3 — temporary but confirm your environment's file policies if you have strict sandboxing. - If you do not want audio sent to OpenAI, ask for a variant that omits the TTS step or run the skill with the OPENAI_API_KEY unset. If the author intends to use another TTS provider, ask them to update the docs and declared env vars. If the author confirms the use of OpenAI TTS and updates the metadata to declare the required env var(s) (and explains the ownerId discrepancy), the skill would be coherent for its stated purpose. Until then, treat the mismatch as a red flag and proceed cautiously.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eagt3zsypfbnwb6gshncns5839t7b
182downloads
0stars
1versions
Updated 7h ago
v1.0.1
MIT-0

News Summary

Overview

Fetch and summarize news from trusted international sources via RSS feeds.

RSS Feeds

BBC (Primary)

# World news
curl -s "https://feeds.bbci.co.uk/news/world/rss.xml"

# Top stories
curl -s "https://feeds.bbci.co.uk/news/rss.xml"

# Business
curl -s "https://feeds.bbci.co.uk/news/business/rss.xml"

# Technology
curl -s "https://feeds.bbci.co.uk/news/technology/rss.xml"

Reuters

# World news
curl -s "https://www.reutersagency.com/feed/?best-regions=world&post_type=best"

NPR (US perspective)

curl -s "https://feeds.npr.org/1001/rss.xml"

Al Jazeera (Global South perspective)

curl -s "https://www.aljazeera.com/xml/rss/all.xml"

Parse RSS

Extract titles and descriptions:

curl -s "https://feeds.bbci.co.uk/news/world/rss.xml" | \
  grep -E "<title>|<description>" | \
  sed 's/<[^>]*>//g' | \
  sed 's/^[ \t]*//' | \
  head -30

Workflow

Text summary

  1. Fetch BBC world headlines
  2. Optionally supplement with Reuters/NPR
  3. Summarize key stories
  4. Group by region or topic

Voice summary

  1. Create text summary
  2. Generate voice with OpenAI TTS
  3. Send as audio message
curl -s https://api.openai.com/v1/audio/speech \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "tts-1-hd",
    "input": "<news summary text>",
    "voice": "onyx",
    "speed": 0.95
  }' \
  --output /tmp/news.mp3

Example Output Format

📰 News Summary [date]

🌍 WORLD
- [headline 1]
- [headline 2]

💼 BUSINESS
- [headline 1]

💻 TECH
- [headline 1]

Best Practices

  • Keep summaries concise (5-8 top stories)
  • Prioritize breaking news and major events
  • For voice: ~2 minutes max
  • Balance perspectives (Western + Global South)
  • Cite source if asked

Comments

Loading comments...