Design Daily
Analysis
Design Daily appears to do what it claims—fetch design news and summarize it with Serper and DeepSeek—but users should protect the API keys it stores locally and only enable the optional daily schedule intentionally.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
requests>=2.28.0 pyyaml>=6.0
The install uses common Python packages, but versions are not exactly pinned or hash-locked.
f" 摘要：{item.get('snippet', '')}",
f" 链接：{item.get('url', '')}",Search-result snippets and links are inserted into the model prompt for summarization; these are untrusted web-derived inputs.
0 9 * * * cd /path/to/Design_Daily && python run.py >> logs/cron.log 2>&1
The documentation provides an optional cron entry that would run the skill automatically every day.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
env_path.write_text(
f"SERPER_API_KEY={serper_key}\n"
f"DEEPSEEK_API_KEY={deepseek_key}\n",The setup wizard stores user-provided provider API keys in a local .env file, and the runtime later uses those keys for Serper and DeepSeek calls.