ai-news-oracle

PassAudited by ClawScan on May 1, 2026.

Overview

The artifacts show a coherent AI-news briefing skill with disclosed external API use and optional wallet-based premium payment, but no evidence of hidden, destructive, or deceptive behavior.

This looks like a benign news-fetching integration. Before installing, check the linked GitHub repository, and only configure wallet/payment features if you intentionally want premium access. Treat the API’s news summaries as external information rather than guaranteed truth.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the user installs from the GitHub link, they may be trusting code or files beyond the single reviewed SKILL.md artifact.

Why it was flagged

The skill points users to an external GitHub install source that is not included in the provided artifact set. The command is user-directed setup, not automatic execution, so this is a provenance note rather than a concern.

Skill content

openclaw install skill https://github.com/swimmingkiim/openclaw-skill-ai-news-oracle

Recommendation

Review the linked repository, owner, and files before installing from that URL.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the premium tier could involve authorizing a wallet payment or transaction for the service.

Why it was flagged

Premium use is documented as involving a Base Wallet payment transaction header. This is disclosed and aligned with the pricing section, but it touches payment authority.

Skill content

Premium | Unlimited | 0.01 USDC | Base Wallet ... use the `x-payment-tx` header

Recommendation

Only enable premium access intentionally, verify the exact cost and transaction details, and avoid giving the agent broad wallet credentials.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Requests to the service may expose normal request metadata such as IP address, and returned news summaries should be treated as external content.

Why it was flagged

The skill is designed to call a third-party API, and the pricing table indicates IP-based limiting. No private user data parameters are documented.

Skill content

Live API: `https://api.ai-news.swimmingkiim.com` ... Free | 1 call / IP

Recommendation

Do not send private data to the API, and verify important news before making decisions based on the briefing.