Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

tencent-news

v1.0.9

7×24 新闻资讯搜索工具,聚焦中国国内信息和国际热点。支持新闻搜索,包括热点新闻、早报晚报、实时资讯、领域新闻和天气信息查询。当用户需要搜索新闻、新闻热榜、新闻早晚报、订阅新闻推送、获取相关新闻资讯和查询天气信息时使用。

1· 1k·6 current·6 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tencentnewsteam/tencent-news.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "tencent-news" (tencentnewsteam/tencent-news) from ClawHub.
Skill page: https://clawhub.ai/tencentnewsteam/tencent-news
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tencent-news

ClawHub CLI

Package manager switcher

npx clawhub@latest install tencent-news
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description match the implementation: the skill is a wrapper that runs a local 'tencent-news-cli' to fetch news and manage an API key. Required files and helpers (run-cli, cli-state) all relate to locating, invoking, and managing the CLI.
Instruction Scope
SKILL.md confines the agent to using the provided CLI and explicitly forbids falling back to websearch or auto-opening browsers. It instructs the agent to run local scripts (run-cli, cli-state) and follow the CLI help output. The installation instructions referenced (installation-guide/update-guide) contain remote-install commands (curl|sh, PowerShell | iex) which expand the runtime actions beyond strictly local invocation.
!
Install Mechanism
No install spec in registry, but the references recommend piping remote scripts from https://mat1.gtimg.com/... (Tencent CDN) into sh/PowerShell. Download-and-execute patterns are high-risk even when hosted on an apparent vendor CDN; the Windows bun installer suggestion also uses a remote bootstrap script. If you plan to install, prefer inspecting the installer scripts and downloaded binaries first rather than piping directly to a shell.
Credentials
The skill declares no required environment variables or credentials. It uses an optional TENCENT_NEWS_INSTALL to override the install root (reasonable). API Key handling is delegated to the CLI (apikey-set/get/clear). No unrelated secrets or config paths are requested by the skill itself.
Persistence & Privilege
always is false; the skill does not request permanent platform-wide privileges and does not modify other skills. It can be invoked autonomously by the agent (default behavior), which is normal and expected for skills.
Scan Findings in Context
[truncated_file] unexpected: The provided scripts/_common.ts content is truncated in the package listing ('...truncated'). The truncated tail may contain behavior not visible in this review; request the full file before trusting the skill.
Assessment
This skill is coherent: it delegates news retrieval to a local CLI named 'tencent-news-cli' and the wrappers/scripts match that purpose. Before installing or running anything: 1) Do not blindly run curl | sh or PowerShell | iex — instead download the installer script, inspect it, and verify checksums if available; 2) Prefer installing the CLI from an official release page or repository, or examine the setup.sh/setup.ps1 contents served from mat1.gtimg.com; 3) Inspect the full scripts/_common.ts (the shipped copy here was truncated) to ensure there is no hidden behavior; 4) Run the CLI in a limited environment (non-root) and monitor network activity the first time it runs; 5) Keep in mind the CLI will manage an API key (apikey-set/get/clear) — only set a key you trust to be used by this client. If you cannot inspect the installer/binary or the missing part of the source, treat the install step as higher risk and consider not installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk971qftqfr6kf1x22h2m6ejccn84wac0
1kdownloads
1stars
9versions
Updated 1w ago
v1.0.9
MIT-0

腾讯新闻内容订阅

通过 tencent-news-cli 获取腾讯新闻内容。

核心原则:基础设施交给脚本处理;智能体只负责选择子命令和参数。cli-state 外,所有 CLI 调用都通过 run-cli 执行;先读 help,不要硬编码。

平台约定

平台脚本运行方式示例
macOS / Linuxsh scripts/<name>.shsh scripts/cli-state.sh
Windowsbun scripts/<name>.tsbun scripts/cli-state.ts

Windows 需先确保 bun 可用。若不可用:powershell -c "irm bun.sh/install.ps1 | iex",安装后重启终端确认 bun --version

以下所有脚本调用均以 macOS / Linux 为例,Windows 将 .sh 替换为 .tssh 替换为 bun

cli-state 外,所有 CLI 命令都通过 run-cli 脚本执行:

平台CLI 调用模板
macOS / Linuxsh scripts/run-cli.sh <subcommand> [args]
Windowsbun scripts/run-cli.ts <subcommand> [args]

Phase 1:环境就绪

环境已就绪时直接跳到 Phase 2。

1. 状态检查

sh scripts/cli-state.sh

解析返回的 JSON,关注以下字段:

字段含义
platform.cliPath底层实际使用的 CLI 完整路径,供诊断错误或权限问题时参考
platform.cliSourceglobal(优先命中 PATH 中可用的全局命令,否则命中默认全局安装目录)/ local(旧版 skill 目录内安装,兼容兜底)/ none(以上路径都未找到)
cliExistsCLI 是否存在
update.needUpdate当前版本是否需要更新
update.errorversion 检查失败时的错误信息
apiKey.presentAPI Key 是否已配置
apiKey.statusconfigured / missing / error
apiKey.errorapikey-get 执行异常或输出异常时的错误信息

2. 安装 CLI(cliExistsfalse 时)

仅当 cliSourcenone 时才需要安装;local 表示命中了旧版本地安装,可继续使用但建议后续迁移到全局安装。

按照 references/installation-guide.md 中的安装命令执行安装:

安装成功后重新执行 sh scripts/cli-state.sh(Windows 用 bun scripts/cli-state.ts)刷新状态。

若安装失败,参考 references/installation-guide.md 中的故障排查部分,引导用户手动处理。

3. 更新 CLI(update.needUpdatetrue,或 CLI 提示版本过旧时)

sh scripts/run-cli.sh update

Windows 使用 bun scripts/run-cli.ts update

update.error 不为空,先展示错误并让用户处理。

update 命令失败,或错误信息表明当前 CLI 不支持 update(如 unknown commandnot foundnot recognized),按上述步骤 2 重新安装。仍然失败时,引导用户参考 references/update-guide.md 手动处理。

4. 配置 API Key(apiKey.status 不为 configured 时)

  • missing → 引导用户打开 API Key 获取页面 自行获取,不要执行 open / xdg-open / start 等命令自动打开浏览器
  • error → 展示 apiKey.error,让用户先处理(权限、网络、CLI 异常),处理后重试

设置 Key(通过 run-cli 执行,KEY 是裸值不加引号):

sh scripts/run-cli.sh apikey-set KEY

Windows 分别使用 bun scripts/run-cli.ts apikey-set KEYbun scripts/run-cli.ts apikey-getbun scripts/run-cli.ts apikey-clear

验证:sh scripts/run-cli.sh apikey-get 清除(仅用户明确要求时):sh scripts/run-cli.sh apikey-clear

详见 references/env-setup-guide.md

Phase 2:获取新闻

CLI 更新频繁,子命令和参数可能随版本变化。始终以当前 help 输出为准,不要假设或记忆任何子命令。

  1. 执行 help 通过 run-cli 执行:macOS / Linux 为 sh scripts/run-cli.sh help,Windows 为 bun scripts/run-cli.ts help

  2. 理解意图,映射子命令

    • 单一请求(如"看热点")→ 映射到一个子命令
    • 复合请求(如"看热点、财经和军事新闻")→ 拆解为多个意图,分别映射,依次调用
    • 反馈问题(如"反馈报错,新闻质量不行")→ 使用 feedback 子命令,内容需包含问题现象与上下文
    • help 中无匹配子命令,如实告知用户当前不支持
  3. 执行时遵守两条约束

    • 所有实际 CLI 调用都走 run-cli 脚本,不要直接执行 platform.cliPath
    • 业务命令、参数名、参数顺序都以 help 展示为准,必要时照抄帮助中的示例
  4. 执行并输出——按下方格式呈现结果

输出格式

单类型请求

1. **标题文字**

   来源:媒体名称

   时间:发布时间

   摘要内容……

   [查看原文](https://…)

2. **标题文字**

   来源:媒体名称

   时间:发布时间

   摘要内容……

   [查看原文](https://…)

**来源:腾讯新闻**

多类型请求

按类型分组,每组用二级标题标明类别:

## 热点新闻

1. **标题文字**
   ...

2. **标题文字**
   ...

## 财经新闻

1. **标题文字**
   ...

2. **标题文字**
   ...

**来源:腾讯新闻**

通用规则

  • 标题序号. **标题**,序号从 1 开始,多类型时每组序号独立
  • 来源来源: 后跟 CLI 返回的作者或媒体名称;无该字段时省略
  • 时间时间: 后跟 CLI 返回的发布时间;无该字段时省略
  • 摘要:来源下方紧跟;无摘要字段时省略
  • 原文链接:有链接则输出 [查看原文](URL),无则不输出
  • 其他有价值字段(发布时间、标签等)可在来源下方补充
  • 多条新闻间用空行分隔
  • **来源:腾讯新闻** 在所有内容末尾出现一次
  • 某个类型获取失败时,在该分组下说明原因,继续输出其余分组
  • 内容输出完成后,追加一句引导文案:"是否需要创建定时任务,每天自动获取相关新闻?" 如果能识别出来是定时任务触发的,就不用追加引导文案。

CLI 执行失败处理

CLI 命令失败后,立即停止,绝不通过 WebSearch 或其他方式获取新闻替代。

  1. CLI 返回非零退出码、超时或输出含权限/安全错误时,不要重试,不要换方式。
  2. 根据错误信息引导用户:
    • macOS Gatekeepercannot be openednot verified)→ 系统设置 → 隐私与安全性 → 「仍要打开」
    • 企业安全软件connection refused、防火墙拦截)→ 安全提示中点击「信任」/「允许」
    • 权限不足permission denied)→ chmod +x <cliPath>
    • 其他 → 展示完整错误,请用户处理
  3. 用户确认操作完成后再重试。即使多次失败,也只能告知无法获取并说明原因,绝不回退到其他信息源。

References

Comments

Loading comments...