新闻早报
v0.1.0用于拉取并展示最新热点内容（接口为 https://hotspot.api4claw.com/hotspots/latest?timestamp=$TIME_STEMP，返回 JSON 数组）。按模型预估点击率生成 Top 条目（不使用原始热度排序）。默认会提示用户创建定时任务（不自动执行），在用户确认后提供 c...
⭐ 0· 88·0 current·0 all-time
by@xltang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (fetch and present latest hotspots) match its declared needs: network access to https://hotspot.api4claw.com and the web_fetch tool. It does not request unrelated binaries, credentials, or config paths.
Instruction Scope
SKILL.md confines runtime behavior to: generate a minute-precision timestamp, call the single API endpoint via web_fetch, parse JSON, rank items by estimated CTR, and present results. It explicitly forbids caching, fabrication, or reading unrelated files/env. The only out-of-skill action is an optional, user-approved cron command example; the doc instructs not to execute automatically.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk or downloaded during install, minimizing install-time risk.
Credentials
No required environment variables or credentials are listed. The only fixed config is the base URL constant. This is proportionate to a read-only consumer skill using a public API.
Persistence & Privilege
always:false and user-invocable:true. The skill suggests (but does not auto-create) a cron entry; scheduled use requires the skill to be present in the scheduled environment. Autonomous invocation remains allowed (platform default) but is not combined with elevated privileges or credential access.
Assessment
This skill appears coherent and low-risk, but before enabling it: (1) confirm you trust the API host (https://hotspot.api4claw.com) because the skill will fetch data from it each run; (2) do not allow the agent to auto-execute the provided cron command — review any generated cron command before running, and only enable scheduling if you understand which agent and channel will run it; (3) be aware the skill requires correct system timezone/time generation for its timestamp logic; (4) monitor sample responses for any unexpected sensitive data and ensure the scheduled environment actually contains this SKILL.md (the cron message assumes the skill is available to the scheduled agent).Like a lobster shell, security has layers — review code before you run it.
latestvk972241jgbn9979rkrwmbmms1h84jk3e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.