naver-news-briefing

What to check and do before installing/using this skill: - Verify the committed data/config.json: the repo already contains a client_id and an encrypted client_secret_enc blob. Confirm these are dummy/example values and not your real credentials. If they are real, remove them from the repo and rotate the secret in Naver Developer Center. - Know where secrets are stored: the CLI stores credentials in data/config.json. On Windows the skill attempts DPAPI encryption; on non-Windows platforms the code falls back to storing the secret in plain text. If you will run this on Linux/macOS, avoid entering secrets that you don't want persisted in cleartext or store them using an external secret manager and keep data/config.json out of version control. - Inspect network targets: the code uses the official Naver Search API endpoint (https://openapi.naver.com/v1/search/news.json) only — there are no hidden external endpoints in the files reviewed. If you plan to run the skill in production, run it in a controlled environment and monitor outbound requests to confirm behavior. - Consider runtime isolation: run the tool under a limited user account and do not run it as a privileged/system account. The skill writes to its own data/ folder and a local SQLite DB; ensure those files are not world-readable if they will contain sensitive secrets. - If you will commit this project or share it, remove any credentials from data/config.json before committing. If you need encrypted-at-rest secrets on non-Windows hosts, integrate with an appropriate secret store rather than relying on the provided plain-text fallback. Overall: the skill is coherent with its stated purpose. The main actionable caution is the presence of a populated config JSON and the plain-text storage fallback on non-Windows — verify and sanitize secrets before use.