ClawHub

News Brief

v1.0.3

Daily Chinese news brief from top global sources (Reuters, Bloomberg, TechCrunch, FT, BBC). Pick up to 3 categories, run setup.py once, get structured briefs...

⭐ 1· 166·1 current·1 all-time
byJack James@tkk0124
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (news brief) align with the implementation: fetch.py uses Serper news endpoints to gather articles and brief.py / fetch.py call DeepSeek for translation/summary/structure. The only required env vars are SERPER_API_KEY and DEEPSEEK_API_KEY, which match the code's API calls. No unrelated credentials or system-wide access is requested.
ℹ
Instruction Scope
SKILL.md and included scripts limit activity to the skill folder: run.py loads config.yaml/.env, calls fetch_all → Serper, and uses DeepSeek to verify/translate/summarize. setup.py is an interactive setup that asks for API keys and writes .env and config.yaml. Note: the skill will send news text and URLs to DeepSeek and Serper (expected for its purpose) and stores API keys in plaintext .env in the skill directory.
✓
Install Mechanism
No install spec or remote downloads are present; code is bundled with the skill. The SKILL.md declares 'requests' and Python >=3.9 which matches imports. No external archives/unknown URLs are fetched during install.
ℹ
Credentials
Only two env vars are required (SERPER_API_KEY, DEEPSEEK_API_KEY), which are justified by the code. However, setup.py writes these keys into a plaintext .env file inside the skill directory and run.py loads .env automatically. If you are concerned about storing credentials on disk, take precautions (see guidance).
ℹ
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It does persist files in its own directory (./.env, config.yaml, output/, logs/). It prints a cron line but does not install it automatically. The skill can be invoked autonomously by the agent (disable-model-invocation is false), which is the platform default.
Assessment
This skill appears to do what it claims: it fetches news via Serper and sends text/metadata to DeepSeek for translation/summary. Before installing: (1) confirm you trust serper.dev and platform.deepseek.com because your API keys and news text will be sent to those services; (2) be aware setup.py will store your API keys in plaintext in a .env file inside the skill folder—remove or secure that file (restrict permissions) if you don't want keys on disk; (3) monitor API usage/charges on those services and consider using a dedicated key with limited quota; (4) run the skill in an isolated or controlled workspace if you want to limit filesystem exposure (it writes logs and output files in the skill directory); (5) the skill prints a crontab suggestion but does not install scheduled tasks automatically.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dv213snf43en7ttkssyjkmd833ht4

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvSERPER_API_KEY, DEEPSEEK_API_KEY

Comments