每日科技播报

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to simply fetch public technology headlines and print a digest, without credentials, persistence, or data-changing behavior.

This looks safe for its stated purpose. Be aware that it makes network requests to Sina Tech and IT Home, and ignore the README's ClawHub publishing/token commands unless you specifically intend to publish the skill yourself.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the skill will contact external public websites to retrieve headlines.

Why it was flagged

The skill is explicitly designed to make outbound HTTP requests to public news sites. This is expected for the stated purpose and the sources are fixed and disclosed.

Skill content

脚本内维护的信息源（无需 API Key，直接 HTTP 抓取）： ... https://tech.sina.com.cn/ ... https://www.ithome.com/

Recommendation

Install only if outbound access to these news sources is acceptable in your environment.

Note

ASI03: Identity and Privilege Abuse

What this means

A ClawHub token could grant account access if copied into an untrusted machine or shared accidentally.

Why it was flagged

The README includes optional publishing instructions that involve a ClawHub token. This is not required for normal news-digest operation, but it is credential handling if a user follows those publishing steps.

Skill content

npx clawhub login --token <粘贴token> --no-browser

Recommendation

Do not use the ClawHub login/publish commands unless you intentionally want to publish the skill, and only handle tokens in trusted environments.