每日毛选文章推送
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill appears to match its stated purpose, but it needs AI/Telegram credentials and can be scheduled to run every day if the user enables the cron job.
This looks safe to install if you want daily generated Mao article notes and Telegram pushes. Before using it, set only the needed credentials, run a test with --chat or --no-send, choose the Obsidian output directory intentionally, and enable the cron schedule only if you want automatic daily execution. Confidence is medium because several listed source files were truncated or omitted from the provided review text.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If configured, the skill can consume the user's DeepSeek API access and send messages through the configured Telegram bot/chat.
The skill requires third-party AI and Telegram credentials, granting the script ability to use API quota and post to the configured Telegram chat.
env:
- DEEPSEEK_API_KEY
- TELEGRAM_BOT_TOKEN
- TELEGRAM_CHAT_IDUse a dedicated Telegram bot/chat, keep environment variables private, and test with --chat or --no-send before enabling normal pushes.
If the user creates the cron job, the skill may run daily and create files or send Telegram messages without further manual action.
The skill documents recurring daily automation, but it is presented as a user-created cron command rather than an automatically installed background task.
openclaw cron create --name "每日毛选文章推送" --schedule "0 9 * * *" --agent your-agent --task "执行每日毛选文章推送"
Only create the cron job if daily automated posting is desired, and know how to disable or remove it later.