Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Generate Daily Sports Update

v1.0.0

Runs the sports science crawler to generate a daily report, sync to Notion, and prevent duplicate content.

0· 326·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's purpose (run a local crawler script and sync to Notion) aligns with the requirements listed inside SKILL.md: python3, NOTION_TOKEN, and NOTION_PAGE_ID. However, the registry-level metadata provided earlier in the package summary lists no required binaries or env vars, which contradicts SKILL.md. That mismatch is an incoherence to clarify before trusting the skill.
Instruction Scope
SKILL.md instructs the agent to run a local Python script (daily_sports_update.py), install requirements from requirements.txt, read/write processed_history.json and produce .md files, and call external services (NCBI and Notion). Those actions are consistent with the stated purpose, but the instructions are somewhat vague about where the script lives ('user's sports-science-daily directory') and implicitly expect the agent to run shell commands via run_command. The vagueness gives the agent broad discretion (e.g., to search the filesystem), so confirm exactly which files/paths will be touched.
Install Mechanism
This is an instruction-only skill with no install spec and no code files delivered by the skill itself. That minimizes installation risk (nothing is downloaded or extracted by the skill package). The SKILL.md does ask the user to install Python dependencies locally (pip3 -r requirements.txt), which is normal for running a user-owned script.
Credentials
The environment variables referenced in SKILL.md (NOTION_TOKEN and NOTION_PAGE_ID) are appropriate for syncing to Notion. However, the earlier registry summary claimed no required env vars — this contradiction should be resolved. No unrelated credentials are requested in the instructions, which is good.
Persistence & Privilege
The skill does not request always:true or any elevated persistent privileges. It does require the ability to run shell commands (run_command) to execute the user's script, which is normal for an instruction that runs a local script.
What to consider before installing
Before installing or invoking this skill: (1) Resolve the metadata inconsistency — confirm whether NOTION_TOKEN and NOTION_PAGE_ID and python3 are actually required (the SKILL.md says they are, the registry summary does not). (2) Inspect the actual daily_sports_update.py and requirements.txt on your machine (or the repository referenced in SKILL.md) to ensure the script's behavior is acceptable — specifically review network calls, any file-system operations, and any third-party packages in requirements.txt. (3) Use a Notion integration with least privilege (scoped token) and do not give broader credentials. (4) Run the script in a controlled environment or sandbox first (or with a dry-run) to confirm it only writes the intended processed_history.json and .md files and only sends data to the expected endpoints (api.notion.com and eutils.ncbi.nlm.nih.gov). (5) If you plan to let an agent run commands for you, restrict what tools it can call or require user confirmation before executing shell commands. If the registry owner/source cannot be verified, treat the skill as higher risk.

Like a lobster shell, security has layers — review code before you run it.

latestvk976m7efrf5zghs5br350rj4c5828qx8
326downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

Generate Daily Sports Update

This skill runs the daily_sports_update.py script to fetch the latest sports science research and wearable tech news. It automatically handles deduplication, so you can run it frequently without worrying about seeing the same content twice.

Prerequisites

  • Python 3: Requires python3 to be installed.
  • Dependencies: The required Python packages defined in requirements.txt must be installed (pip3 install -r requirements.txt).
  • Environment Variables:
    • NOTION_TOKEN: The integration token for Notion API.
    • NOTION_PAGE_ID: The ID of the Notion page to sync the daily update to.
  • Tools Needed: You must have access to the run_command tool to execute the script in a bash terminal.

Instructions

  1. Locate the Script: The script daily_sports_update.py is located in the user's sports-science-daily directory. You should first ensure you are in the correct working directory.

  2. Run the update: Use the run_command tool to execute the python script.

    python3 daily_sports_update.py --days 2
    
    • --days N: (Optional) Number of days to look back (default is 7). If you haven't run it in a while, increase this (e.g., --days 7 or --days 30).
    • --no-history: (Optional) Use this ONLY if you want to force re-fetching of already seen items (e.g., for debugging).
  3. Output & Sync:

    • The script will generate a local Markdown file named: YYYY-MM-DD_运动科学日报.md
    • It will automatically sync the compiled blocks directly to the specified Notion page using the Notion APIs.
    • It updates processed_history.json locally to mark fetched URLs/PMIDs as seen.
  4. Handling "No New Content":

    • If the script's terminal output contains "🎉 没有发现新内容" (No new content found), it means all found items in the lookback period have already been processed and synced previously. You can try running with a larger --days argument.

Security & Privacy Note

  • External Endpoints Called:
    • https://eutils.ncbi.nlm.nih.gov: Accessed to fetch PubMed paper statistics and abstracts.
    • https://api.notion.com: Accessed to create and populate the daily reports.
    • Various RSS feed URLs (e.g., Garmin, MySportScience, YouTube RSS).
  • Files Checked: Opens and updates processed_history.json and creates .md reporting files locally in the working directory.
  • This skill invokes web requests to fetch relevant sports science data but does not expose any user PII.

Comments

Loading comments...