Generate tech news digests with unified source model, quality scoring, and multi-format output. Six-source data collection from RSS feeds, Twitter/X KOLs, Gi...
Security Analysis
high confidenceThe skill's code, SKILL.md instructions, and optional environment variables are coherent with a news-digest pipeline — nothing requested or installed is out of proportion with its stated purpose.
Name/description (tech news digest from RSS/Twitter/GitHub/Reddit/web) match the bundled scripts, templates, and config files. Declared binaries (python3 + optional mail/gog/gh/openssl/weasyprint) and optional API keys align with fetching, PDF generation, GitHub token generation, and email delivery. The README's marketing about one-line install is optimistic but not malicious.
Runtime instructions explicitly read config/defaults/, scripts/, and the workspace archive, and write temporary outputs to /tmp and archive files in <workspace>/archive/tech-news-digest/. This is expected for deduplication and archive-based behavior, but means the skill will read files under the agent workspace and may read a GH app private key file path if provided. The SKILL.md also documents safety rules (e.g., do not interpolate untrusted content into shell args).
No install spec — instruction-only (lowest install risk). The repo contains Python scripts and a requirements.txt; SKILL.md states the skill does not run pip install automatically. There are no downloads from untrusted URLs or extracted archives in the install metadata.
All API keys and credentials (Twitter/X, twitterapi.io, Brave/Tavily, GitHub token or GitHub App fields) are optional and appropriate for the listed external integrations. The only sensitive file access is the optional GH_APP_KEY_FILE (private key PEM) used to generate a GitHub App JWT via openssl if the user enables that flow — this is proportional to the auto-token generation feature but requires the user to supply a private key file. No unrelated credentials are requested.
always:false and no indication the skill modifies other skills or system-wide agent settings. It writes archive files under the workspace and temp files in /tmp (expected for pipeline/attachments). Autonomous invocation is allowed (platform default), but not elevated here.
Guidance
This skill appears to do exactly what it says: collect from RSS/Twitter/GitHub/Reddit/web, score and deduplicate items, and render/send digests. Before installing: (1) ensure python3 and any optional tools you want (weasyprint for PDFs, openssl for GitHub App JWT signing, an MTA or gog for email) are present; (2) only set API keys you intend to use — all are optional; (3) if you enable GitHub App auto-token generation, provide GH_APP_KEY_FILE only from a trusted location because it contains a private key used to sign JWTs; (4) be aware the skill reads and writes files in the agent workspace (workspace/archive/tech-news-digest/) and /tmp — avoid storing unrelated secrets in those locations; (5) if you plan to enable automated scheduling/delivery, confirm the delivery method (Discord via message tool or local mail/gog) is configured and acceptable. Overall coherent, but follow least-privilege practices for supplying keys and private key files.
Latest Release
v3.14.0
BLOG_PICKS_COUNT placeholder, SKILL.md alignment, cron docs update
More by @dinstein
Published by @dinstein on ClawHub
