NewsToday

NewsToday solves information overload for users who want to stay informed without spending an hour checking scattered sources. Instead of manually browsing W...

Security Scan

NewsToday’s code and runtime instructions are coherent with its stated purpose (RSS/WebSearch aggregation, user prefs, and scheduled push delivery) and do not request unexplained credentials or system access.

Purpose & Capability

The skill claims to aggregate RSS and WebSearch results, summarize them, and deliver push briefings. The included scripts implement registration, preference storage, prompt-generation for morning/evening/breaking briefs, RSS feed lists, and cron-registration stubs. No unrelated credentials, binaries, or system paths are requested. The delivery channels (telegram/feishu/slack/discord) are referenced but the skill relies on the OpenClaw platform/session infrastructure rather than embedding bot tokens — this is consistent with a platform-handled delivery model.

Instruction Scope

SKILL.md and the scripts limit actions to: producing LLM prompts, reading/writing per-user JSON under data/users (with path sanitization), and emitting cron registration lines. The scripts instruct the agent to perform WebSearch/WebFetch of public feeds and public URLs listed in rss-fetch.js — expected behaviour for a news aggregator. They do not instruct reading arbitrary files, environment variables, or contacting hidden endpoints. Input is white-listed where appropriate (topics, userId, channels).

Install Mechanism

There is no install spec and all code is bundled with the skill (node scripts). Nothing is downloaded from arbitrary URLs or executed from external archives. package.json only declares runtime metadata and npm scripts. This is low-risk compared to remote installs.

Credentials

The skill declares no required environment variables, credentials, or config paths. It stores minimal user profiles under data/users/<userId>.json and validates/sanitizes inputs. The lack of any secret requests aligns with the claimed design (platform handles delivery sessions).

Persistence & Privilege

always is false and the skill does not require elevated privileges. It persists only its own user profiles under data/users and emits cron registration markers (__OPENCLAW_CRON_ADD__/__OPENCLAW_CRON_RM__) to request scheduling on the platform — expected for push functionality. It does not modify other skills or system-wide configs.

Assessment

This skill appears internally consistent: it reads and writes user preference files in data/users, generates prompts for an LLM to perform WebSearch/WebFetch of public RSS and web results, and asks the platform to schedule push jobs via printed cron-registration markers. Before installing, consider: 1) the skill will cause the agent to fetch public web pages and search queries (normal for a news aggregator) — ensure you are comfortable with those network requests and any logging of queries; 2) delivery to Telegram/Slack/Feishu/Discord depends on platform-managed sessions (no bot tokens are stored by the skill), so verify your OpenClaw platform handles channel/session authorizations as you expect; 3) user profiles (userId, language, topic weights, channel, push status) are stored locally under data/users — review whether local storage and retention are acceptable for your environment; 4) the skill’s source/homepage is unknown — if provenance matters, prefer skills with a known publisher or review the code yourself. Overall the behavior matches the description and nothing requested is disproportionate.

私人新闻助手 — 早报 · 晚报 · RSS聚合 · 突发提醒 · 话题追踪 · 个性化推送

何时使用

• 用户说"早报""今天新闻""新闻摘要""今天发生了什么"
• 用户问"热搜""微博热榜""知乎热榜""X热帖"
• 用户说"AI 早报""AI 最新""人工智能动态"
• 用户想看某类新闻：科技、AI、财经、娱乐、体育、社会、国际、军事
• 用户说"追踪 XX""XX 最新消息""XX 怎么样了"
• 用户说"开启推送""订阅早报""每天推新闻"
• 用户说"突发""重大消息""有什么大事"

---

🌐 语言规则

• 默认中文；用户英文提问切英文
• 新闻标题保留原文，摘要用回复语言改写

---

📋 功能说明

早报

从 RSS（新浪/澎湃/36氪/BBC中文/Reuters中文）+ WebSearch 双源聚合，去重后选10条覆盖不同领域，按用户话题偏好加权排序。头部显示今日条数和预估阅读时长。第1条为头条（重要性最高，3-4句详细摘要+影响分析），其余9条常规格式（标题、来源、2句摘要）。财经类每条含影响评级：📈 利好 / 📉 利空 / ➡️ 中性。

晚报

收官3-5条当日重要新闻 + 1-2条热点最新进展 + 明日日程预告。

突发新闻提醒

每2小时检测（08:00-22:00），仅在满足阈值（7级以上地震、市场熔断、重大政策等）时推送，不骚扰用户。

热榜聚合

搜索微博热搜 + 知乎热榜 + 百度热搜 + X（Twitter）热帖，去重合并，标注来源，多平台共同热点置顶。X 热帖作为第三方实时信号，补充国内平台之前的舆情风向；若 X 数据不可用则静默降级，不影响其他来源输出。

话题追踪

搜索 {关键词} 最新 {日期} + {关键词} 进展 + {关键词} 官方回应，时间线倒序输出，含各方反应。

深读

用户回复序号或说"详细说说 XX"时，多角度搜索，交叉验证，呈现详细经过、各方反应、延伸阅读。

AI 早报（独立模式）

用户说"AI 早报""AI 最新""人工智能动态"时触发独立模式：专门搜索 AI 最新进展 {日期}、大模型 新闻、OpenAI Anthropic Google DeepMind 动态，输出 5 条 AI 专项摘要，含产品发布、研究突破、行业动向，与常规早报格式一致但信源更聚焦。

分类浏览

分类	搜索词
科技	科技新闻 今日、AI新闻
AI	AI 最新进展、大模型 新闻、OpenAI Anthropic 动态
财经	财经新闻 今日、股市
娱乐	娱乐新闻 今日
体育	体育新闻 今日、赛事结果
社会	社会新闻 今日、民生
国际	国际新闻 今日、外交
军事	军事新闻 今日、地区冲突、国防政策、军事演习

---

🔧 脚本说明

# 注册（可选，解锁个性化推送）
node scripts/register.js <userId> [language] [topics] [channel]
# 示例：
node scripts/register.js alice zh 科技,财经,国际 telegram
node scripts/register.js bob en tech,finance telegram

# 话题偏好
node scripts/preference.js show <userId>
node scripts/preference.js set <userId> <话题> <权重0-1>
node scripts/preference.js reset <userId>

# 手动触发（不需要注册）
node scripts/morning-push.js [userId]
node scripts/evening-push.js [userId]
node scripts/rss-fetch.js [--lang zh|en] [--topics 科技,财经,国际]
node scripts/breaking-alert.js <userId>

# 推送管理
node scripts/push-toggle.js on <userId> [--morning 08:00] [--evening 20:00] [--channel telegram]
node scripts/push-toggle.js off <userId>
node scripts/push-toggle.js status <userId>

支持渠道：telegram / feishu / slack / discord

---

⚠️ 注意事项

1. 每条新闻必须标注来源媒体
2. 涉及争议内容呈现多方视角，不做立场判断
3. 不注册可直接使用早晚报；注册后可按话题个性化、开启突发提醒
4. 用户数据仅存储推送偏好和话题权重（data/users/<userId>.json），不含新闻内容
5. RSS 源无法访问时自动降级为 WebSearch，不影响正常使用