Skills ai-news-pro

📦

ai-news-pro

Name: ai-news-pro
Author: me-news

v0.9.1 Content revision r1 High Risk 🌐 Network access⚙️ External commands

Generate Curated AI News Briefings

Monitoring AI news across a busy day takes time and produces inconsistent summaries. This skill builds ranked, categorized briefings from configured ME News feeds.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "ai-news-pro" from https://skillstore.io/skills/me-news-ai-news-pro.md and its manifest at https://skillstore.io/api/skills/me-news-ai-news-pro/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/me-news-ai-news-pro.md Signed manifest GET /api/skills/me-news-ai-news-pro/manifest Signed lockfile GET /api/skills/me-news-ai-news-pro/lockfile

Test it

Using "ai-news-pro". Query the AI morning briefing.

Expected outcome:

AI Morning Brief | 2026.08.05

Large Models
1. Example model release
A short factual summary of the announced capability.
Source: publisher link

Trend: Model efficiency and agent integration lead current coverage.

Using "ai-news-pro". Show the 24-hour AI hot-news ranking.

Expected outcome:

1. Major AI product update: concise summary and source link.
2. AI funding announcement: concise summary and source link.
3. New safety policy: concise summary and source link.
Trend: Product launches and governance changes are moving together.

Security Audit

High Risk

v1 • 8/5/2026 Open versioned report

The skill intentionally contacts four allowlisted ME News API endpoints and instructs the agent to use curl, creating genuine network and external-command exposure. The scheduled-task example creates persistent execution, while entropy and most backtick detections are documentation false positives. API content is not explicitly isolated from agent instructions, leaving an indirect prompt-injection risk.

Files scanned

401

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:87

Windows scheduled task creation

schtasks /create /tn "AI-News-Pro早报" /tr "openclaw agent --message '查询 AI 早报'" /sc daily /st 12:00

The command creates a named Windows task that invokes openclaw every day. The persistence is disclosed and user initiated, but it is a real persistent system modification.

Medium

SKILL.md:131-147

Indirect Prompt Injection Exposure

The workflow extracts and summarizes external API fields without instructing the agent to treat fetched text as untrusted data. Malicious feed content could attempt to alter tool use or generated output.

The documented workflow clearly feeds external API content into agent classification, formatting, and optional delivery. No instruction isolation or validation rule is documented.

Capability review items (13)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:85-88

Ruby/shell backtick execution

```powershell

The fenced block includes an executable schtasks command that creates a daily task. It is documented openly, but it makes a persistent host change.

Medium

SKILL.md:77-82

Ruby/shell backtick execution

```bash

The fenced block contains executable crontab entries that invoke openclaw on a schedule. Arguments are fixed, but applying them creates persistent external-command execution.

Medium

SKILL.md:131

Ruby/shell backtick execution

2. **调用 API(优先 `curl`,`web_fetch` 兜底)**:按 `sources.md` 配置,优先使用 `curl` 调用 AI 数据源 API

The skill directly instructs the agent to invoke curl for API collection. Endpoint allowlisting limits exposure, but an external process is intentionally executed.

Medium

SKILL.md:132-133

Ruby/shell backtick execution

- AI 新闻 API(`curl`)

This collection step assigns the AI news API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.

Medium

SKILL.md:133-134

Ruby/shell backtick execution

- OpenClaw 新闻 API(`curl`)

This collection step assigns the OpenClaw news API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.

Medium

SKILL.md:134-135

Ruby/shell backtick execution

- AI 行业大事件 API(`curl`)

This collection step assigns the industry events API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.

Medium

SKILL.md:135-136

Ruby/shell backtick execution

- MetaEra AI 快讯(`curl`)

This collection step assigns the MetaEra feed to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.

Medium

SKILL.md:150

Ruby/shell backtick execution

- `sources.md` 中所有 URL 均为 API endpoint,必须优先使用 `curl` 获取数据。

This rule requires curl requests to all configured API endpoints, confirming intended external-process and network use. The URLs are allowlisted, reducing injection risk.

Medium

SKILL.md:156-157

Ruby/shell backtick execution

- 建议优先使用 `curl` 调用 API endpoint

The skill recommends invoking curl against an API endpoint, which is genuine external-command use. It does not construct a command from user input.

Low

SKILL.md:96

Hardcoded URL

| MetaEra AI 快讯 | https://agent.me.news/skill/flash/list?page=1&size=20&category=ai | API | AI 分类快讯流

This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.

Low

SKILL.md:97

Hardcoded URL

| AI 新闻 API | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=ai | API | AI 新闻列

This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.

Low

SKILL.md:98

Hardcoded URL

| OpenClaw 新闻 API | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=openclaw |

This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.

Low

SKILL.md:99

Hardcoded URL

This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.

Detected Patterns

Windows scheduled task creation

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/me-news-ai-news-pro/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/me-news-ai-news-pro/security.svg)](https://skillstore.io/skills/me-news-ai-news-pro?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/me-news-ai-news-pro?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/me-news-ai-news-pro/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/me-news-ai-news-pro.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

me-news. (2026). ai-news-pro security audit report (audit version 1) [Author version 0.9.1]. Skillstore. https://skillstore.io/skills/me-news-ai-news-pro/audits/1

BibTeX citation

@techreport{me-news-me-news-ai-news-pro-2026,
  author = {me-news},
  title = {ai-news-pro security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/me-news-ai-news-pro/audits/1},
  note = {Author version 0.9.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ai-news-pro security audit report (audit version 1)"
version: "0.9.1"
type: report
authors:
  - name: "me-news"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/me-news-ai-news-pro/audits/1"
identifiers:
  - type: other
    value: "skillstore:me-news-ai-news-pro:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare a Daily Research Brief

Generate a concise morning report of important model, agent, safety, and product developments.

Track Product and Market Changes

Review ranked funding, acquisition, release, and industry-event updates from the last 24 hours.

Publish a Team News Digest

Format selected AI stories for delivery through an already configured messaging channel.

Try These Prompts

Get the Morning Briefing

Query the AI morning briefing for today. Show up to 10 ranked items with categories, summaries, and source links.

Review Recent Hot News

Query the 24-hour AI hot-news ranking. Prioritize high-scoring items and include one concise trend observation.

Analyze Selected Categories

Generate an AI evening briefing focused on agents, safety, and open source. Keep factual details and source links.

Build an Executive Trend Brief

Create a 24-hour executive AI digest. Rank major events, separate product and market signals, identify repeated themes, and note uncertain claims.

Best Practices

Confirm that you trust agent.me.news before enabling network access.
Open source links before using a briefing for important decisions.
Preview reports and verify the destination before enabling automatic message delivery.

Avoid

Do not treat API-provided AI scores as independent fact checks.
Do not add unapproved endpoints or replace the configured source allowlist.
Do not create scheduled tasks without explicit user approval and a removal plan.

Frequently Asked Questions

Which sources does this skill use?

It uses four configured endpoints on agent.me.news for AI articles, OpenClaw news, flash updates, and industry events.

Can it search the public web?

No. The instructions restrict collection to URLs listed in sources.md.

How are stories ranked?

The skill sorts by the API-provided AI score when that field is available.

Can it send reports automatically?

Yes, but delivery requires a separately configured message tool, channel, credentials, and external scheduling.

Does the skill store messaging credentials?

No. Its documentation states that credentials must be managed outside the skill.

Are the summaries verified for accuracy?

No. Review important claims and follow the included source links before making decisions.

Developer Details

Author

me-news

License

MIT

Author version

v0.9.1

Skillstore revision

Repository

https://github.com/me-news/agent-skills/tree/34400d7a68276f70f53404d8b6859ef926699cd4/skills/ai-news-pro

Ref

e5f4ac55b99872f66a36ead0049c5c56486976b8

Maintenance freshness

8/5/2026

Usage

0 downloads · 0 views

File structure

📄 _meta.json

📄 format.md

📄 skill-card.md

📄 SKILL.md

📄 sources.md

ai-news-pro

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (2)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Prepare a Daily Research Brief

Track Product and Market Changes

Publish a Team News Digest

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details