Skills/ClawHub/ai-weekly

ai-weekly@4.1.6

CAUTION

Publisher claims: "把「本周 AI 行业动态」做成一个可搜索、可筛选、支持暗色模式的单文件 HTML 周报。 用户用日常说法就能触发,例如「这周 AI 有什么大事」「给我看个 AI 简报」「做个 AI 周报」。 数据来自 14 个公开 RSS 源(国内 7 + 国外 7,国内优先),默认不调用任何付费或商业 API。 适合:AI 周报 / AI 新闻汇总 / AI 行业动态速览 / 模型排行榜与市场融资数据整理。 不适合以下情形,请勿触发: - 用户要的是「即时单条新闻」或「回答一个 AI 领域问题」,而非一份成体系的周报/简报; - 用户指定了非AI 主题(时政、体育、财经等); - 用户只想要纯文本对话输出——此时直接在对话里回答,不要生成 HTML; - 用户要求部署、推送、改仓库设置等运维动作(见正文「能力边界」,这些不属本技能触发能力)。 典型触发:这周 AI 有什么大事。 典型不触发:帮我看下今天沪深300 多少点。 能力边界(重要):本技能**默认触发的动作**只是生成新闻内容——抓取、生成 HTML、校验、展示;报告生成流程本身不部署、不推送飞书、不改仓库设置、不 git push。 但本包**确实随附**部署 / 飞书推送 / 排行榜刷新 / 系统调度等工具(publish.py、deploy.py、deploy_ghpages.py、refresh_deploy.py、install_scheduler.py 等)。它们是**独立的、需显式调用**的能力——只有在你明确点名执行对应命令时才运行,绝不会在「生成周报」时被自动触发。各工具的默认安全边界: - 飞书推送(publish.py / feishu_connector.py,二者等价、二选一,切勿同跑两次):默认经 feishu_target.json 发一张卡片;不想要推送就别调用这俩命令。 - 部署(deploy_ghpages.py / deploy.py):需显式调用,默认只本地提交、**不推送**;需显式 --push 才推送(--no-push 保留作兼容)。`deploy.py` 是统一多后端分发入口(github-pages 后端内部调用 deploy_ghpages.py),其 `deploy()` 默认同样 no_push=True,`publish.py --deploy` 分发路径与此一致。 - 排行榜刷新(refresh_deploy.py):默认仅本地生成+提交、**不推送**,需显式 --push 才部署。 - 系统调度(install_scheduler.py):注册的定时任务**默认仅本地刷新、永不自动推送**;仅当你显式 --enable-push 才允许定时自动推送 gh-pages(需 GH 凭据)。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher elisabeth15501 · joined 10 days agoInstalls 839Last detonated 5d ago

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompt injection attempt; Access to sensitive file paths; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Prompt injection attemptCHANGELOG.md:62 · Prompt injection attempt — model control tokensFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsscripts/fetch_ai_news.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsscripts/deploy.py:218 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsscripts/fetch_ai_news.py:130 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/generate_site.py:129 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagedelivery/deploy_config.example.json:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsscripts/deploy.py:184 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialsscripts/deploy_ghpages.py:188 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedscripts/build_pages_site.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/aiweekly/utils.py:192 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/aiweekly/utils.py:150 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/aiweekly/utils.py:196 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/deploy.py:68 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detecteddelivery/feishu_connector.py:175 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/aiweekly/utils.py:182 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/install_scheduler.py:76 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/deploy_ghpages.py:159 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/install_scheduler.py:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/deploy.py:256 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/generate_site.py:36 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/install_scheduler.py:63 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/install_scheduler.py:94 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/install_scheduler.py:85 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/deploy_ghpages.py:191 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressscripts/generate_site.py:129 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/refresh_deploy.py:62 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/refresh_deploy.py:25 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/refresh_deploy.py:22 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/refresh_deploy.py:86 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/refresh_deploy.py:53 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/preflight.py:120 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim elisabeth15501: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim elisabeth15501