Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feedship
v1.5.0Manage RSS/Atom feeds, subscribe to websites, search and read articles. Use when working with feeds, RSS, Atom, subscribing to content sources, managing an i...
⭐ 0· 70·1 current·1 all-time
byYan Zer0@yanpeipan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (RSS/Atom, discovery, semantic search) matches the instructions: installing feedship with 'ml' and 'cloudflare' extras, fetching feeds, and building embeddings is coherent. The declared required binary 'uv' is consistent with the provided install commands (uv tool install).
Instruction Scope
SKILL.md stays within feed-management scope: it instructs installing the tool, fetching feeds, discovery, and running searches. It does suggest persistent changes (adding exports to ~/.bashrc) and running feedship fetch --all to populate local vector DB; these are reasonable for the described functionality but are actions that modify user environment and create local storage.
Install Mechanism
There is no built-in install spec in the skill; instructions tell the user to run 'uv tool install' pulling from PyPI or a GitHub repo. Using PyPI/GitHub is expected, but the install will pull heavy ML dependencies (sentence-transformers, chromadb) and a scraping extra; those are proportionate but increase attack surface. The GitHub URL shown is a direct repo install (typical but worth verifying).
Credentials
No required credentials are declared. The doc suggests optionally setting HF_ENDPOINT and PIP_INDEX_URL for mirrors; these are plausible for environments with restricted network access but could redirect package and model downloads to arbitrary endpoints if misconfigured. The skill does not request unrelated secrets.
Persistence & Privilege
always:false (no forced inclusion). Metadata includes a cron default to fetch every 30 minutes, which is coherent for a feed fetcher. The instructions also propose adding exports to ~/.bashrc (user-level persistence). These behaviors create ongoing network activity and local data (database/vector store) but do not request elevated system privileges.
Assessment
This skill appears to be what it says: a feed manager with optional semantic search. Before installing: 1) Verify the 'uv' CLI referenced is the tool you expect and is trusted on your system. 2) Inspect the feedship package source (PyPI page or the GitHub repo) before running install, especially if using the git+https install. 3) Be aware the 'ml' extras will pull large ML libraries (sentence-transformers, chromadb) — they will consume disk space and may download models. 4) Exercise caution when following the mirror instructions: only set HF_ENDPOINT or PIP_INDEX_URL to mirrors you trust (a malicious mirror can serve poisoned packages or model files). 5) Note that running the tool and the cron behavior will create local databases (article storage and embeddings) and schedule periodic network fetches; if you want no persistence, avoid adding exports to ~/.bashrc and review what feedship stores (config/db paths reported by feedship info). If you need higher assurance, ask the publisher for an official homepage or signed releases, or audit the repository before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97dq9kptndztg8rp7n0p9qmx584b8wm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsuv