Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Simple news feed reader (RSS)
v1.0.0Fetch latest news headlines from major RSS feeds (BBC, Reuters, AP, Al Jazeera, NPR, The Guardian, DW). No API keys required.
⭐ 0· 2.4k·12 current·12 all-time
by@lknik
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, SKILL.md, and scripts/news.py are coherent: the skill requires only python3 and the bundled script fetches/parses RSS feeds from the listed publishers. One feed (AP) points at rsshub.app (a third‑party RSS aggregator) rather than the publisher's canonical feed URL — not necessarily malicious but worth noting.
Instruction Scope
SKILL.md simply instructs running the included Python script with flags; the script only performs HTTP GETs to the feed URLs and parses XML, returning headlines. There are no instructions to read unrelated files, environment variables, or to exfiltrate data to unexpected endpoints.
Install Mechanism
No install spec (instruction-only) and a single included Python script — nothing is downloaded or installed at runtime beyond using python3 on PATH.
Credentials
The skill declares no required environment variables or credentials and the code does not access any secrets — requested permissions are minimal and appropriate for the described purpose.
Persistence & Privilege
A bundled .claude/settings.local.json file grants permissions such as WebSearch and several Bash command patterns (including git operations). These permissions are unnecessary for a simple RSS reader and represent a mismatch between declared needs and included configuration. While not proof of malicious intent, it increases the attack surface if applied by an agent runtime.
What to consider before installing
The script itself is straightforward and appears to do only what the description says: fetch and parse RSS feeds using Python stdlib. Before installing: 1) Inspect and remove or ignore the .claude/settings.local.json file if you don't want the extra WebSearch/Bash/git permissions applied by your agent environment. 2) Note that the AP feed points to rsshub.app (a third‑party aggregator) — if you prefer canonical feeds, replace that URL. 3) The script makes outbound HTTP requests to the listed news domains, so run it in an environment where outbound network access is acceptable. 4) If you want extra assurance, run the script locally in a sandbox or review/execute it manually rather than allowing autonomous agent invocation. These steps will reduce risk and align the skill's runtime permissions with its simple purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk97a546p5487ktxy617kv4b71980jrks
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3