Skills aimpact

📦

aimpact

Name: aimpact
Author: me-news

v0.8.1 Content revision r1 High Risk 🌐 Network access⚙️ External commands

Create Ranked AI News Briefings

Tracking AI news across the day takes time and produces duplicate results. AIMPACT fetches fixed news feeds, filters them, and creates ranked briefings.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "aimpact" from https://skillstore.io/skills/me-news-aimpact.md and its manifest at https://skillstore.io/api/skills/me-news-aimpact/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/me-news-aimpact.md Signed manifest GET /api/skills/me-news-aimpact/manifest Signed lockfile GET /api/skills/me-news-aimpact/lockfile

Test it

Using "aimpact". Query the AIMPACT morning brief.

Expected outcome:

AI Morning Brief | 2026.08.05
Models: A ranked headline, a concise factual summary, and its source link.
Agents: A ranked headline, a concise factual summary, and its source link.
Trend note: The leading stories show stronger focus on agent reliability and deployment controls.

Using "aimpact". Show the 24-hour hot-news ranking.

Expected outcome:

A category-organized list of recent AI stories, ordered by available AI score, with concise summaries, source links, and one trend observation.

Security Audit

High Risk

v1 • 8/5/2026 Open versioned report

Most detections are false positives caused by Markdown syntax, sample article links, and multilingual text. The skill does direct agents to retrieve remote content and provides persistent scheduling commands. Remote API content may also be forwarded without explicit content-safety checks.

Files scanned

401

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:87

Windows scheduled task creation

schtasks /create /tn "AIMPACT早报" /tr "openclaw agent --message '查询 AIMPACT 早报'" /sc daily /st 12:00

The documented schtasks command creates persistent daily agent execution on Windows. Although optional and disclosed, running it changes host state and schedules future activity.

High

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism

This combination is common in malware that maintains access

The skill combines curl-driven remote content retrieval with an example that creates recurring scheduled agent execution. The intent is disclosed, but persistent retrieval increases exposure to compromised remote content.

Medium

SKILL.md:137-147

Untrusted API Content Can Be Automatically Forwarded

Remote API fields are formatted into reports and may be sent through a configured message tool without explicit content validation or per-run approval. A compromised source could distribute misleading or adversarial text.

The documented workflow extracts remote fields, formats them, and optionally pushes the result. No validation or instruction-isolation step appears in that workflow.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:131

Ruby/shell backtick execution

2. **调用 API(优先 `curl`,`web_fetch` 兜底)**:按 `sources.md` 配置,优先使用 `curl` 调用 AIMPACT 数据源 API

The workflow explicitly directs the agent to use curl or web_fetch against fixed remote endpoints. This is legitimate retrieval, but it executes an external tool and consumes untrusted network responses.

Medium

SKILL.md:132-133

Ruby/shell backtick execution

- AIMPACT AI 新闻(`curl`)

Medium

SKILL.md:133-134

Ruby/shell backtick execution

- AIMPACT OpenClaw 新闻(`curl`)

Medium

SKILL.md:134-135

Ruby/shell backtick execution

- AIMPACT 行业大事件(`curl`)

Medium

SKILL.md:135-136

Ruby/shell backtick execution

- MetaEra AI 快讯(`curl`)

Medium

SKILL.md:136

Ruby/shell backtick execution

- 仅当 `curl` 不可用或请求失败时,才使用 `web_fetch` 对同一 URL 兜底重试(遵循下方“API 抓取规则(强约束)”)

Medium

SKILL.md:150

Ruby/shell backtick execution

- `sources.md` 中所有 URL 均为 API endpoint,必须优先使用 `curl` 获取数据。

Medium

SKILL.md:151

Ruby/shell backtick execution

- 仅当 `curl` 不可用或请求失败时,才允许使用 `web_fetch` 对同一 URL 兜底重试。

Medium

SKILL.md:156-157

Ruby/shell backtick execution

- 建议优先使用 `curl` 调用 API endpoint

Medium

SKILL.md:157

Ruby/shell backtick execution

- `web_fetch` 仅作为兜底手段(`curl` 不可用或失败时)

Low

SKILL.md:96

Hardcoded URL

| MetaEra AI 快讯 | https://agent.me.news/skill/flash/list?page=1&size=20&category=ai | API | ME News

This fixed ME News endpoint is an active source used by the collection workflow. Requests expose the run to remote availability, integrity, and content-supply risks.

Low

SKILL.md:97

Hardcoded URL

| Aimpact AI 新闻 | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=ai | API | ME

This fixed ME News endpoint is an active source used by the collection workflow. Requests expose the run to remote availability, integrity, and content-supply risks.

Low

SKILL.md:98

Hardcoded URL

| Aimpact OpenClaw 新闻 | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=opencla

This fixed ME News endpoint is an active source used by the collection workflow. Requests expose the run to remote availability, integrity, and content-supply risks.

Low

SKILL.md:99

Hardcoded URL

This fixed ME News endpoint is an active source used by the collection workflow. Requests expose the run to remote availability, integrity, and content-supply risks.

Detected Patterns

Windows scheduled task creation

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/me-news-aimpact/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/me-news-aimpact/security.svg)](https://skillstore.io/skills/me-news-aimpact?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/me-news-aimpact?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/me-news-aimpact/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/me-news-aimpact.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

me-news. (2026). aimpact security audit report (audit version 1) [Author version 0.8.1]. Skillstore. https://skillstore.io/skills/me-news-aimpact/audits/1

BibTeX citation

@techreport{me-news-me-news-aimpact-2026,
  author = {me-news},
  title = {aimpact security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/me-news-aimpact/audits/1},
  note = {Author version 0.8.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "aimpact security audit report (audit version 1)"
version: "0.8.1"
type: report
authors:
  - name: "me-news"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/me-news-aimpact/audits/1"
identifiers:
  - type: other
    value: "skillstore:me-news-aimpact:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare an Executive AI Brief

Create a short ranked digest for a daily leadership review.

Monitor AI Product Trends

Review recent model, agent, product, and open-source developments by category.

Build a Research Watchlist

Collect recent AI events and high-scoring articles for further source verification.

Try These Prompts

Get the Morning Brief

Query the AIMPACT morning brief. Show the most relevant items in the standard format.

Review the Last 24 Hours

Query the 24-hour hot-news ranking. Group results by category and order them by available AI score.

Focus on Selected Categories

Query recent AIMPACT content. Prioritize model, agent, and safety news, then explain the leading trend using verified report details.

Create a Delivery-Ready Evening Report

Generate the AIMPACT evening brief. Deduplicate items, retain source links, identify missing scores, and prepare the final report for my configured channel.

Best Practices

Verify important claims through the linked original sources before making decisions.
Review the configured endpoint allowlist before each deployment or source change.
Test reports manually before enabling scheduled delivery to an external channel.

Avoid

Do not treat AI scores as independent evidence of accuracy or importance.
Do not forward unreviewed reports into sensitive or public channels.
Do not replace failed allowlisted endpoints with unapproved web searches.

Frequently Asked Questions

Which reports can this skill create?

It creates morning, evening, 24-hour hot-news, and selected AI content reports.

Where does the news come from?

The skill uses four ME News API endpoints documented in its source configuration.

Does it search the public web?

No. Its instructions restrict retrieval to the configured API endpoint allowlist.

How are articles ranked?

The skill sorts by AI score when the API provides one, then limits the selected results.

Can it send reports automatically?

Yes, but only through a host messaging tool and channel that the user configures separately.

Does the skill verify every article?

No. Users should review linked sources before relying on important claims.

Developer Details

Author

me-news

License

MIT

Author version

v0.8.1

Skillstore revision

Repository

https://github.com/me-news/agent-skills/tree/34400d7a68276f70f53404d8b6859ef926699cd4/skills/aimpact

Ref

e5f4ac55b99872f66a36ead0049c5c56486976b8

Maintenance freshness

8/5/2026

Usage

0 downloads · 0 views

File structure

📄 _meta.json

📄 format.md

📄 skill-card.md

📄 SKILL.md

📄 sources.md

aimpact

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Prepare an Executive AI Brief

Monitor AI Product Trends

Build a Research Watchlist

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details