HF Daily Papers (OFR Edition)

筛选并按六大领域分类推送每日 Hugging Face 热门 OFR 相关论文，支持 Markdown 和 Telegram 格式输出。

Security Scan

The skill mostly does what it says (fetches Hugging Face/arXiv papers and generates Markdown/Telegram text) but includes runnable scripts that send Telegram messages via an external openclaw CLI and requires environment variables not declared in the manifest — a mismatch that could cause unexpected network activity or automated pushes if executed.

Purpose & Capability

The code (generator.py, script.sh) matches the stated purpose of collecting HF/arXiv papers and producing Markdown/Telegram outputs. However, run_and_send.sh will attempt to publish messages via an 'openclaw' CLI to a TELEGRAM_TARGET — this capability is consistent with the 'push: Telegram' note in SKILL.md but the registry metadata lists no required env vars or binaries. The manifest omission (no TELEGRAM_TARGET or required binary declared) is an incoherence.

Instruction Scope

SKILL.md documents running generator.py and mentions a proxy and cron job. It does not document the run_and_send.sh workflow or the TELEGRAM_TARGET / OPENCLAW_BIN requirements, yet the package includes run_and_send.sh which will read the generated Markdown and send messages via the openclaw CLI. That expands runtime scope (network egress to messaging) beyond the explicit CLI examples in SKILL.md and hides an action that transmits content externally.

Install Mechanism

No install spec (instruction-only plus included scripts) — nothing is downloaded or extracted at install time. The project uses standard Python and shell scripts; no risky remote install URLs are present.

Credentials

The registry declares no required env vars, but SKILL.md and code rely on HF_DAILY_PAPERS_PROXY (documented) and the included run_and_send.sh requires TELEGRAM_TARGET and optionally OPENCLAW_BIN. TELEGRAM_TARGET (a messaging target) and the dependency on an externally-configured openclaw messaging client are not declared in the skill metadata, creating a gap between what the skill needs and what is advertised. Also generator.py forcibly sets HTTP_PROXY/HTTPS_PROXY to a localhost proxy default (http://127.0.0.1:7890) which changes network routing by default.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide configuration, and only writes outputs to a local 'recommendations' directory. There is no persistent privileged presence requested in the manifest.

What to consider before installing

This package appears to implement its stated function (fetch HF/arXiv papers, classify, and produce Markdown/Telegram text) but there are a few issues to be aware of before installing or running it: - Missing manifest declarations: run_and_send.sh requires TELEGRAM_TARGET (and relies on an openclaw CLI) but the skill metadata lists no required env vars or binaries. If you run that script (or an autonomous agent activates it) it will attempt to send the generated content to whatever TELEGRAM_TARGET is configured via the openclaw messaging client. Confirm you trust the target and the openclaw CLI configuration. - Outbound messaging risk: The repository contains a script that will publish messages to Telegram. If you do not want automated external posting, do not run run_and_send.sh and do not allow the agent to invoke it autonomously. Consider removing or editing that script to require manual confirmation. - Proxy behaviour: generator.py sets a default HTTP_PROXY/HTTPS_PROXY to http://127.0.0.1:7890 unless you override HF_DAILY_PAPERS_PROXY. This will change how network requests are routed (and may fail if you do not run a local proxy). If you have a local proxy that logs traffic, be aware the skill will use it by default. - Minor implementation issues: The helper send script embeds a Python here-doc that uses __file__ (likely to fail when run that way); the message-extraction regexes may not match the generator output — these are functional bugs, not necessarily security issues, but they affect behavior. What to do: inspect or run generator.py locally first (it only contacts huggingface.co and arxiv.org), and manually open the produced files in 'recommendations'. If you want Telegram pushes, review and run run_and_send.sh only after setting TELEGRAM_TARGET and verifying your openclaw messaging configuration. If you do not want external posting, remove or disable run_and_send.sh. If you need higher confidence, ask the publisher to update the skill metadata to declare TELEGRAM_TARGET/OPENCLAW_BIN and to document the send workflow and proxy behavior.

HF Daily Papers (OpenClaw Skill) — OFR 定制版

从 Hugging Face Daily Papers 热榜筛选 OFR 相关论文，按 6 大领域分类推送。

领域分类

领域	关键词示例
🎬 Restoration & Enhancement	restoration, denoising, super-resolution, scratch, flicker, colorization
🎞️ Video & Temporal	video, temporal, optical flow, frame interpolation, propagation
⚡ Efficient Architecture	efficient, pruning, quantization, distillation, real-time
🔭 Vision Backbone & Attention	transformer, attention, mamba, SSM, deformable, swin
🌊 Frequency & Wavelet	wavelet, frequency, fourier, FFT, DWT, subband
🎨 Diffusion & Generative Prior	diffusion, GAN, generative, flow matching, autoregressive

输出

• Markdown: recommendations/YYYY-MM-DD.md
• Telegram: recommendations/YYYY-MM-DD.telegram.txt（--telegram flag）

CLI

cd /workspace/openclaw/skills/hf-daily-papers
python3 generator.py              # 仅 Markdown
python3 generator.py --telegram   # Markdown + Telegram 格式

代理

默认使用 http://127.0.0.1:7890（Clash）。可通过环境变量覆盖：

export HF_DAILY_PAPERS_PROXY=http://127.0.0.1:7897

Cron 配置

• Job ID: 04db7928-d6c1-4b7d-aa9c-5bc1d399b58c
• 时间: 每天 08:00 上海时间
• 推送: Telegram

来源

https://github.com/henry-y/openclaw-paper-tools