Security audit
Security checks for vulnerabilities and agentic risk
The skill is a news-digest tool, but it overstates its AI and push features and runs another local skill through a subprocess, so it should be reviewed before installation.
Install only if you are comfortable with a Chinese-focused news digest that may run on a schedule, write brief files under the skill's scripts/output directory, and rely on a separate local SearXNG skill in your OpenClaw workspace. Review or remove the cron setup if you do not want recurring runs, and verify the SearXNG skill before using this one.
A skill that claims one set of features but actually performs different local writes and external/local search operations creates a transparency and consent problem. In the context of a scheduled automation skill, undocumented behavior is more dangerous because it may run repeatedly without active user supervision.
A skill that claims one set of features but actually performs different local writes and external/local search operations creates a transparency and consent problem. In the context of a scheduled automation skill, undocumented behavior is more dangerous because it may run repeatedly without active user supervision.
A skill that claims one set of features but actually performs different local writes and external/local search operations creates a transparency and consent problem. In the context of a scheduled automation skill, undocumented behavior is more dangerous because it may run repeatedly without active user supervision.
A skill that claims one set of features but actually performs different local writes and external/local search operations creates a transparency and consent problem. In the context of a scheduled automation skill, undocumented behavior is more dangerous because it may run repeatedly without active user supervision.
A skill that claims one set of features but actually performs different local writes and external/local search operations creates a transparency and consent problem. In the context of a scheduled automation skill, undocumented behavior is more dangerous because it may run repeatedly without active user supervision.
The script reads and executes the contents of a sibling file with exec(), which gives that file unrestricted code execution in the current process. If fetch_news_v3.py is modified, replaced, or supplied from an untrusted source, an attacker can run arbitrary Python code under the skill's privileges; the news-brief context does not justify dynamic code loading this way.
v3_script = Path(__file__).parent / "fetch_news_v3.py"
if v3_script.exists():
with open(v3_script, "r", encoding="utf-8") as f:
exec(f.read())
else:
print("错误：fetch_news_v3.py 不存在")
sys.exit(1)
The entire skill documentation, examples, categories, and configuration guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking region. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill description says it will automatically fetch news and regularly push summaries to the user's chat software, and later mentions channels like QQ/微信/Telegram/Discord. For a markdown file, this is a behavior that can affect privacy or system/network integrity, but the README does not include any explicit warning or disclosure about external transmission.
The skill advertises operational behavior that implies network access, local file reads/writes, and shell/subprocess use, yet it declares no explicit tool scope or permissions. This weakens reviewability and consent boundaries, making it easier for a skill to overreach at runtime or for users to install it without understanding the real access it needs.
The skill promotes automatic scheduled pushing to QQ/WeChat/Telegram but does not clearly warn users that content may be sent to external messaging platforms on a recurring basis. That omission can cause unintended data disclosure, spam, or policy violations if users enable scheduling without understanding the outbound delivery behavior.
The config hard-codes "Asia/Shanghai" as the timezone, which imposes a locale setting without any indication of user opt-in or justification. The policy for natural-language concerns applies to config values as well, and this locale constraint could conflict with users in other regions.
This JSON file is a manifest/config file, so SQP-3 applies. The categories, source group names, and keyword queries are predominantly fixed to Chinese-language usage, which can impose a specific language/locale without user opt-in or documented justification.
The module docstring says the script performs 'AI 提炼重点', but the implemented generate_brief function only formats category headers and titles from search results. There is no model invocation, summarization step, or analysis of article content in this file, so the documentation overstates what the code actually does.
The file’s natural-language description and implementation are hard-wired to Chinese behavior: it describes the tool entirely in Chinese and later forces SearXNG searches with --language zh. The policy allows locale constraints only when the user is given a choice or when the constraint is clearly documented and justified as region-specific; neither is present here.
The skill invokes another local skill from a user home workspace, creating a trust boundary crossing that is broader than a simple news-fetching script. If that external searxng skill is altered or compromised, this skill becomes a launcher for arbitrary or unintended behavior, which is more dangerous because the dependency is outside the current file's control.
This code hard-codes the search language to zh, and the surrounding comments/docstrings indicate the skill is designed entirely around Chinese output. That is a natural-language locale constraint with no user opt-in or configurable alternative, which matches the policy violation category for forced language or locale.
The skill description says it will 'AI 提炼重点', implying model-driven summarization or extraction of key points. In this file, the generated brief is just a templated listing of article titles by category, and no AI/model call or summarization logic appears anywhere in the workflow.
The description includes '定时推送', which implies automated delivery to users on a schedule. This script only writes markdown and JSON files to a local output directory and prints status to stdout; it contains no timer, scheduler integration, or outbound delivery mechanism.
The module docstring at L04-L05 states this is a daily news brief that uses a web_search API to directly search same-day news, while the function docstring and comments at L16-L18 admit it merely returns example data. This is an active contradiction between the documented intent and the implemented behavior, not just missing detail.
The skill executes another local skill/tool from a user workspace via subprocess, creating a trust boundary violation: behavior depends on whatever code is present in ~/.openclaw/workspace/skills/searxng. If that external script is modified or replaced, this news skill becomes a launcher for unreviewed code, which is risky in an agent environment.
The subprocess command hard-codes --language zh, and the script’s output and search query are also fixed to Chinese. This imposes a specific language/locale on users without any opt-in or documented region-specific justification, matching the language/locale policy violation criteria.
The manifest describes a skill that fetches hot news and produces an AI brief. While network retrieval is expected, spawning a subprocess to run uv run scripts/searxng.py from another workspace introduces cross-skill execution capability beyond ordinary news fetching and summarization.
The subprocess call hard-codes the search parameter --language zh, which constrains results to Chinese. For this code file, that is a natural-language locale policy concern because no user opt-in or documented region-specific justification is present in the file.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--language", "zh"
]
result = subprocess.run(
cmd,
cwd=searxng_dir,
stdout=subprocess.PIPE,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--language", "zh"
]
result = subprocess.run(
cmd,
cwd=searxng_dir,
stdout=subprocess.PIPE,
No suspicious patterns detected.