外贸资讯聚合器 (多源 RSS + 翻译 + 飞书推送)

自动抓取外贸相关多源RSS新闻，翻译标题生成中文Markdown报告，支持飞书机器人推送更新。

Security Scan

The skill's code mostly matches its stated purpose (RSS fetch → Baidu translate → Feishu push), but there are inconsistent/missing declarations and a few runtime assumptions that don't line up with the manifest or documentation.

Purpose & Capability

The name/description (multi-source RSS, translation, Feishu push) aligns with the included scripts: daily-news.sh fetches RSS and calls Baidu, classify_news.py builds a Feishu card, trend_analysis.py generates weekly stats. However the registry metadata at the top claims no required env vars/binaries whereas SKILL.md and clawhub.json declare BAIDU_APPID/BAIDU_SECRET and command-line tools (curl, jq, md5sum, xmlstarlet). Also the Python scripts need Python and the 'requests' library but that dependency is not declared.

Instruction Scope

SKILL.md instructs setting BAIDU credentials and optionally FEISHU_WEBHOOK and running the scripts — that fits the task. But trend_analysis.py will exit if FEISHU_WEBHOOK is unset (it treats the webhook as required), contradicting SKILL.md's 'optional' label. classify_news.py also attempts to POST to the webhook without checking it's non-empty. The scripts read/write files under the user's home (~/trade-news.md, ~/.openclaw/workspace/history) — expected for this use but worth noting.

Install Mechanism

This is instruction-only (no install spec), lowering install risk. But the runtime requirements are incomplete: the shell script lists system binaries (curl, jq, md5sum, xmlstarlet) yet the package manifest and SKILL.md omit Python and the Python 'requests' package required by the .py files. The absence of an explicit install step or dependency install is a usability/consistency issue.

Credentials

Requested secrets (BAIDU_APPID, BAIDU_SECRET) are proportional to the translation feature. FEISHU_WEBHOOK is a reasonable optional integration. However there are contradictory signals: the top-level registry metadata says 'Required env vars: none', clawhub.json lists the three env vars, SKILL.md marks FEISHU_WEBHOOK optional, but trend_analysis.py treats FEISHU_WEBHOOK as required. These inconsistencies increase risk of misconfiguration and accidental leaks if users set envs expecting different behavior.

Persistence & Privilege

The skill does not request elevated privileges or 'always: true'. It writes user-visible files in the user's home directory (~/trade-news.md and ~/.openclaw/workspace/history) and will run Python scripts; this is standard for a user-level RSS aggregation tool. Nothing modifies other skills or system-wide agent settings.

What to consider before installing

This skill appears to implement what it claims, but several inconsistencies and missing runtime declarations mean you should be cautious before installing. Specifically: (1) the code requires BAIDU_APPID and BAIDU_SECRET (translation) and will use a FEISHU_WEBHOOK to post content — confirm you trust the webhook destination; (2) the package/registry metadata incorrectly lists no required env vars while the scripts do require secrets — fix or verify env settings before running; (3) the Python scripts require Python 3 and the 'requests' library (not declared) — install those in a controlled environment (virtualenv) first; (4) trend_analysis.py currently will fail unless FEISHU_WEBHOOK is set despite SKILL.md marking it optional; (5) the scripts write files to your home (~/trade-news.md and ~/.openclaw/workspace/history) — review and, if desired, run in an isolated account or container. If you plan to use it, ask the author to correct the manifest (declare Python + requests, clarify FEISHU_WEBHOOK requirement) or run the scripts in a sandbox until those inconsistencies are resolved.

Version: 2.3.3

简介

自动抓取外贸相关 RSS 源（支持自定义关键词），调用百度翻译 API 生成中文标题，生成 Markdown 报告并可选推送到飞书群。

功能

• 抓取多个 RSS 源（默认使用 Bing News 搜索外贸关键词）
• 自动翻译标题（英 → 中，支持自动检测源语言）
• 生成 Markdown 报告：~/trade-news.md
• 飞书机器人推送（可选）
• 自动分类新闻（帽子/面料/运费/关税/电商/运动服饰/汇率/国际关系/合规/行业动态）
• 生成近7天趋势周报（各类别新闻数量及占比）

依赖

• curl, jq, md5sum, xmlstarlet（必须安装）
• 百度翻译 API（免费，每月 100 万字符）
• 飞书自定义机器人（可选）

环境变量

变量	必填	说明
BAIDU_APPID	✅	百度翻译 App ID
BAIDU_SECRET	✅	百度翻译密钥
FEISHU_WEBHOOK	❌	飞书机器人 Webhook

安全说明

本 Skill 不会自动加载任何外部 .env 文件。请通过环境变量或直接在 crontab 中设置密钥。

网络要求

本 Skill 需要访问 Bing News 和百度翻译 API。如果您的运行环境无法直接访问外网，请配置代理（例如 export http_proxy=http://your-proxy:port）。

安装与配置

1. 获取百度翻译 API 密钥

• 访问 百度翻译开放平台
• 注册/登录，申请通用翻译 API（免费版）
• 记录 App ID 和 密钥

2. 创建飞书机器人（可选）

• 在飞书群中添加“自定义机器人”
• 复制 Webhook URL

3. 设置环境变量

将以下内容添加到 ~/.bashrc 或执行脚本前 export：

export BAIDU_APPID="你的AppID"
export BAIDU_SECRET="你的密钥"
export FEISHU_WEBHOOK="你的飞书Webhook地址"