ai-news-oracle
v1.0.0Fetch real-time AI news briefings from the AI News Oracle API (Hacker News, TechCrunch, The Verge). Uses a10m.work registry for discovery and Paymaster for gasless transactions.
⭐ 2· 3.2k·34 current·35 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to aggregate news, run deterministic summaries using a local Qwen-2.5-Coder model, and integrate with a Base Paymaster for gasless transactions. Yet the manifest declares no model dependency, no install steps, and no credentials. A legitimate implementation would usually require either (a) a declared dependency or download for the local model or (b) credentials and RPC configuration for the Base wallet / paymaster. The SKILL.md's suggested openclaw install command points to an external GitHub repo, which is inconsistent with the skill having no install spec in the registry metadata.
Instruction Scope
The SKILL.md tells an agent to 'connect' to an API on the Base Chain, summarize using a local model, and use an x-payment-tx header for premium access, but it gives no concrete runtime steps, no explicit handling of private keys, and no fallback if the local model isn't present. This is open-ended and grants the agent broad discretion (e.g., to obtain or access a local model or wallet) without specifying where/how those sensitive artifacts should be provided.
Install Mechanism
There is no install spec in the registry (instruction-only), which is low friction. However, the SKILL.md suggests running 'openclaw install skill https://github.com/swimmingkiim/openclaw-skill-ai-news-oracle' — a command that would fetch code from an external GitHub repo. That external install step is not represented in the skill metadata; any real install could pull arbitrary code, so this discrepancy is a risk that should be verified by inspecting the referenced repository before running the installer.
Credentials
The skill declares no required environment variables or credentials, yet the documentation references a 'Base Wallet', USDC payments, and an 'x-payment-tx' header for premium tier usage. Those features normally require private keys, RPC endpoints, or service credentials. The absence of declared env vars or config paths is under‑specified and disproportionate to the claimed blockchain/payment functionality.
Persistence & Privilege
The skill does not request permanent presence ('always' is false), does not declare disabling model invocation, and lists no config paths. It does not request elevated persistent privileges in the registry metadata.
What to consider before installing
Do not install or provide secrets until you verify missing pieces. Ask the developer for: (1) the GitHub repository contents referenced by the install command and a review of any code that would run on install; (2) a clear explanation of how the Qwen-2.5-Coder local model is supplied (download link, size, runtime requirements) or whether a hosted LLM is used instead; (3) exact requirements and recommended safe handling for payments (how x-payment-tx is generated, whether a private key is needed, and where it is stored). If you test, use a read-only or throwaway wallet (never supply a private key from your primary account), restrict network access if possible, and prefer inspecting the external API domain (https://api.ai-news.swimmingkiim.com) and the GitHub repo before running any install. If the developer cannot provide clear, verifiable answers (code + deployment docs), treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk974z0zyq58xxs5z731ymc0cps80wy2y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.