行业情报助手

行业情报收集与分析助手。自动监控特定行业动态、抓取热点资讯、生成结构化情报简报，并支持多渠道推送。当用户需要：监控某行业最新动态、追踪竞品消息、抓取AI/科技/电商等行业情报、生成每日/每周情报简报、搭建企业级资讯分发体系时使用此技能。核心功能：(1) Tavily搜索获取行业资讯 (2) 结构化简报生成 (3)...

Security Scan

The skill's stated purpose (Tavily-based industry intelligence, report generation, and scheduled pushes) matches the included scripts, but there are several coherence and safety issues — missing declarations (TAVILY_API_KEY, openclaw CLI), a referenced but absent push script, and an unsafe shell invocation that could allow command injection.

Purpose & Capability

The skill claims to use Tavily search, build reports, push to enterprise channels, and schedule cron tasks — and the included scripts implement those features. However the package metadata declares no required environment variables or binaries while the SKILL.md and scripts clearly require a TAVILY_API_KEY and the openclaw CLI. That mismatch is incoherent: TAVILY_API_KEY should be listed as a required credential and openclaw should be listed as a required binary.

Instruction Scope

SKILL.md instructs running the included scripts and to configure OpenClaw plugins. But the documentation references scripts (e.g., scripts/push_to_wecom.py) that are not present in the file manifest. The schedule script creates agent payloads that will cause autonomous agent turns (expected function) but also builds shell commands containing user-provided query text — the script constructs a shell command with unescaped user input, which is a command-injection risk. The scripts also read TAVILY_API_KEY from environment, which is necessary for operation but was not declared in metadata.

Install Mechanism

There is no formal install spec (instruction-only), which is lower-risk in principle. The references recommend 'pip install tavily-python --break-system-packages' — the use of --break-system-packages is intrusive and potentially problematic on some systems. The code imports a third-party tavily package; installing packages is required but not formally declared in install metadata.

Credentials

The scripts require TAVILY_API_KEY (format tvly-xxx) and expect OpenClaw plugin credentials/config for enterprise messaging channels, but the skill metadata lists no required env vars or primary credential. That omission is misleading. Requiring an API key for the integrated service is proportionate — but it should be declared. Also the skill will cause content to be sent to configured channels; the user must ensure those channel credentials are configured elsewhere and understand what data will be pushed.

Persistence & Privilege

always:false and default autonomous invocation are appropriate. However the schedule_intel.py uses 'openclaw cron add' to create tasks that will autonomously invoke agent turns and push messages; combined with the command-injection vulnerability (shell=True using interpolated, unsanitized query text), scheduling could be abused to run unexpected shell commands or to cause broad autonomous network activity. This combination increases risk and should be remediated before use.

What to consider before installing

Key points to check before installing or running this skill: - Do not run these scripts in a sensitive or production environment until you verify them. Run first in an isolated VM or container. - The skill requires a Tavily API key (TAVILY_API_KEY) and the openclaw CLI, but these are not declared in the skill metadata — treat the metadata as incomplete and expect manual configuration. - A referenced push script (scripts/push_to_wecom.py) is mentioned in SKILL.md but is not included. Ask the publisher for the missing file or remove references before use. - schedule_intel.py constructs a shell command with user-controlled fields and calls subprocess.run(..., shell=True). This is a command-injection risk: malicious or malformed query/schedule inputs could execute arbitrary shell commands. Before using, either sanitize/quote inputs (e.g., use shlex.quote) or change to subprocess.run([...], shell=False). - The README suggests installing tavily-python; verify you install the official package from a trustworthy source (PyPI / official docs). Avoid using --break-system-packages unless you understand effects on your system package manager. - Confirm how OpenClaw plugins for enterprise messaging are configured and what credentials they store; verify that pushing reports will only go to intended recipients. - Recommended next actions: request the publisher to (1) update metadata to declare TAVILY_API_KEY and openclaw required binaries, (2) include the missing push script or remove instructions that reference it, and (3) fix schedule_intel.py to avoid shell=True with unescaped user input. If the publisher cannot address these, treat the skill as unsafe to deploy.

Industry Intel Assistant

行业情报收集与分析助手。自动监控特定行业动态，生成结构化简报并推送到指定渠道。

核心能力

1. Tavily 搜索 — 调用 Tavily API 获取指定行业/关键词的最新资讯
2. 简报生成 — 将搜索结果整理为结构化情报简报（标题 + 摘要 + 来源链接）
3. 多渠道推送 — 支持推送到企业微信、飞书、钉钉等平台
4. 定时编排 — 支持 Cron 定时任务，实现每日/每周自动化情报推送

快速开始

基本搜索

# 搜索特定行业资讯，返回5条结果
python3 scripts/tavily_industry_search.py "AI大模型 最新动态" --max-results 5

生成简报并推送

# 搜索 + 生成中文简报
python3 scripts/generate_intel_report.py --query "跨境电商 2026 动态" --max-results 8 --language zh

推送到企业微信

python3 scripts/push_to_wecom.py --report-file ./assets/latest_report.md --channel wecom

脚本说明

scripts/tavily_industry_search.py

行业资讯搜索脚本。

python3 scripts/tavily_industry_search.py "<关键词>" \
  --max-results <1-10> \
  --topic <general|news> \
  --depth <basic|advanced>

参数说明：

• query: 搜索关键词，支持行业、竞品、话题组合
• --max-results: 返回结果数量，默认 5
• --topic: 搜索范围，general=全网，news=最近7天新闻
• --depth: 搜索深度，basic=快速(1-2s)，advanced=深度(5-10s)

环境变量：

• TAVILY_API_KEY: Tavily API Key（格式: tvly-xxx）

返回： JSON 格式搜索结果，包含 title、url、content、score

scripts/generate_intel_report.py

生成结构化情报简报。

python3 scripts/generate_intel_report.py --query "<行业关键词>" \
  --max-results <数量> \
  --language <zh|en> \
  --output <输出文件路径>

输出格式：

# [行业] 情报简报 — YYYY-MM-DD

## 今日要点
- 要点1
- 要点2

## 热门资讯
1. [标题](链接) — 摘要
2. [标题](链接) — 摘要
...

## 来源
- [来源1](链接)
- [来源2](链接)

scripts/push_to_wecom.py

推送简报到企业微信。

python3 scripts/push_to_wecom.py --report-file <文件路径> --channel <wecom|feishu|ddingtalk>

前置要求：

• 企业微信插件已配置（OpenClaw wecom 插件已启用）
• 推送目标为企业内部群或用户

scripts/schedule_intel.py

创建定时情报推送任务。

python3 scripts/schedule_intel.py \
  --query "<关键词>" \
  --schedule "0 9 * * *" \
  --channel <wecom|feishu|ddingtalk> \
  --timezone "Asia/Shanghai"

使用 OpenClaw cron 系统创建每日定时推送任务。

典型使用场景

场景1：每日 AI 行业简报

python3 scripts/generate_intel_report.py \
  --query "AI大模型 GPT Claude Gemini 生成式AI 最新动态" \
  --max-results 8 \
  --language zh \
  --output ./assets/daily_ai_report.md

场景2：竞品监控

python3 scripts/tavily_industry_search.py "竞品名称 最新消息 融资 动态" --topic news --max-results 10

场景3：跨境电商情报

python3 scripts/generate_intel_report.py \
  --query "跨境电商政策 平台动态 热门品类 2026" \
  --max-results 8 \
  --language zh \
  --output ./assets/ecommerce_intel.md

配置说明

Tavily API Key

获取方式：

1. 访问 https://tavily.com 注册账号
2. 在 Dashboard 生成 API Key（格式: tvly-xxx）
3. 配置到 OpenClaw：openclaw config set skills.entries.tavily.apiKey "tvly-xxx"

多渠道推送

企业微信/飞书/钉钉需在 OpenClaw 中配置对应插件，参考各平台插件配置文档。

进阶用法

自定义搜索关键词

可组合多个关键词提升搜索精度：

• "AI大模型 最新进展" — 大模型行业动态
• "竞品名称 融资 上市 动态" — 竞品追踪
• "行业政策 法规 2026" — 政策解读

与知识库结合

可将简报内容自动存入企业知识库：

1. 先生成简报
2. 使用知识库技能（knowledge-curator）将内容归档
3. 建立历史情报索引

自动化工作流

利用 OpenClaw cron 实现完全自动化：

1. 每日定时触发简报生成
2. 自动推送到指定渠道
3. 异常时发送告警通知