Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent2RSS - AI Content to RSS Feed
v0.2.1Agent2RSS 客户端，管理 RSS 频道并推送内容。触发：用户提到 Agent2RSS/RSS 频道/推送文章/上传文章/创建频道/设置默认频道/幂等性。
⭐ 1· 720·1 current·1 all-time
byYao Tutu@yaotutu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included script and docs. Required tools (bash, curl, jq) and operations (create channels, upload posts, health checks) are appropriate for an RSS push client. No unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md and the script clearly limit runtime actions to reading/writing a config file in the skill-data directory and making HTTP(S) calls to the configured serverUrl (default https://agent2rss.yaotutu.top:8765). The instructions do not attempt to read other user files or system credentials. Note: the script will read/write $HOME/.openclaw/workspace/.skill-data/agent2rss-client/config.json where channel tokens are stored.
Install Mechanism
No install spec — instruction-only plus a helper shell script. Nothing is downloaded or installed at runtime by the skill itself, minimizing install-time risk.
Credentials
The skill declares no required env vars but supports optional CONFIG_DIR/CONFIG_FILE/SERVER_URL/DRY_RUN. Channel tokens are persisted in the skill's config.json and used as 'Authorization: Bearer <token>' when calling the configured server. Storing tokens locally and sending them to the default remote service is expected for this function but is sensitive — the skill attempts to set file permissions to 600, but you should verify file safety and only use trusted servers.
Persistence & Privilege
always is false and the skill does not request system-wide privileges. The script writes only to its own skill-data config path and does not modify other skills or global agent settings.
Assessment
This skill appears to do what it says: it manages RSS channels and pushes content to a configured Agent2RSS server. Before installing or using it, consider: (1) The default server is a remote host (https://agent2rss.yaotutu.top:8765). Only use that host if you trust it — you can set SERVER_URL to a self-hosted instance. (2) Channel tokens (secrets) are stored in ~/.openclaw/workspace/.skill-data/agent2rss-client/config.json and are sent to the configured server as Authorization headers; ensure that file is not committed to version control and has appropriate permissions. (3) If you have sensitive content, self-host the server or review the server's privacy/security before sending posts. (4) You can review and run the provided scripts locally to confirm behavior; rotate tokens if you suspect exposure.Like a lobster shell, security has layers — review code before you run it.
ai-agentvk97fvk6dd0j60mp7ye3a0jq3cs81549bautomationvk97fvk6dd0j60mp7ye3a0jq3cs81549bcontent-publishingvk97fvk6dd0j60mp7ye3a0jq3cs81549bfeedvk97fvk6dd0j60mp7ye3a0jq3cs81549blatestvk9706agnfkv1mc40p9saz2sdan81xd0gmarkdownvk97fvk6dd0j60mp7ye3a0jq3cs81549brssvk97fvk6dd0j60mp7ye3a0jq3cs81549b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.