Finance News Briefings

The declared skill purpose (market news briefings) matches the repository contents (RSS fetchers, summarizers, delivery workflows). However the registry metadata lists no required env vars or binaries while README/SKILL.md and scripts clearly assume use of external CLIs (openclaw, lobster), and environment variables like FINANCE_NEWS_TARGET and FINANCE_NEWS_CHANNEL. That mismatch (no declared requirements but the code expects delivery targets and CLI tools) is incoherent and could surprise users.

Runtime docs and cron scripts instruct the agent to read/write local config files (config/config.json, config/portfolio.csv), schedule cron jobs, and run Lobster/OpenClaw workflows that send messages. The docs also include an explicit procedure to export browser session cookies into config/cookies.json to fetch paywalled content — this requires copying session tokens (sensitive data) from your browser into a local file. The SKILL.md and included docs therefore ask for potentially sensitive data and to perform system changes (cron entries, message sends) outside simple summarization.

There is no formal install spec in the registry (instruction-only), but the bundle includes many code files, Dockerfile, and Python scripts. README recommends Docker or native Python install (venv + pip). No remote download URLs or archive extracts are used here, which lowers install risk, but you should still inspect and/or run inside an isolated container before giving it network or messaging permissions.

Registry metadata declares no required environment variables, yet scripts and README rely on FINANCE_NEWS_TARGET, FINANCE_NEWS_CHANNEL, and SKILL_DIR. The cron scripts provide a default FINANCE_NEWS_TARGET value (a WhatsApp group JID: [email protected]) if the variable is unset — that default target could cause messages to be sent to an external group unintentionally. The docs also advise creating config/cookies.json containing session tokens for premium sources — storing browser cookies locally is sensitive and not justified for most users. Overall requested/assumed environment access is underdeclared relative to the code and docs.

The skill is not marked always:true and does not request elevated platform privileges. However its instructions and cron scripts encourage adding scheduled jobs (crontab or openclaw cron) and running Lobster workflows that will automatically send briefings. That means once installed and configured, it can persistently send messages on a schedule (normal for this use case) — users should be explicit about cron additions and the delivery target before enabling automation.