技能 ai-news-pro
📦
ai-news-pro
v0.9.1 內容修訂 r1 高風險 🌐 網路存取⚙️ 外部命令
Generate Curated AI News Briefings
Monitoring AI news across a busy day takes time and produces inconsistent summaries. This skill builds ranked, categorized briefings from configured ME News feeds.
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "ai-news-pro" from https://skillstore.io/skills/me-news-ai-news-pro.md and its manifest at https://skillstore.io/api/skills/me-news-ai-news-pro/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「ai-news-pro」。 Query the AI morning briefing.
預期結果:
AI Morning Brief | 2026.08.05
Large Models
1. Example model release
A short factual summary of the announced capability.
Source: publisher link
Trend: Model efficiency and agent integration lead current coverage.
正在使用「ai-news-pro」。 Show the 24-hour AI hot-news ranking.
預期結果:
- 1. Major AI product update: concise summary and source link.
- 2. AI funding announcement: concise summary and source link.
- 3. New safety policy: concise summary and source link.
- Trend: Product launches and governance changes are moving together.
安全審計
高風險v1 • 2026/8/5 開啟版本化報告
The skill intentionally contacts four allowlisted ME News API endpoints and instructs the agent to use curl, creating genuine network and external-command exposure. The scheduled-task example creates persistent execution, while entropy and most backtick detections are documentation false positives. API content is not explicitly isolated from agent instructions, leaving an indirect prompt-injection risk.
5
已掃描檔案
401
分析行數
13
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
高
Windows scheduled task creation
schtasks /create /tn "AI-News-Pro早报" /tr "openclaw agent --message '查询 AI 早报'" /sc daily /st 12:00
The command creates a named Windows task that invokes openclaw every day. The persistence is disclosed and user initiated, but it is a real persistent system modification.
中
Indirect Prompt Injection Exposure
The workflow extracts and summarizes external API fields without instructing the agent to treat fetched text as untrusted data. Malicious feed content could attempt to alter tool use or generated output.
The documented workflow clearly feeds external API content into agent classification, formatting, and optional delivery. No instruction isolation or validation rule is documented.
能力複核項目 (13)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Ruby/shell backtick execution
```powershell
The fenced block includes an executable schtasks command that creates a daily task. It is documented openly, but it makes a persistent host change.
中
Ruby/shell backtick execution
```bash
The fenced block contains executable crontab entries that invoke openclaw on a schedule. Arguments are fixed, but applying them creates persistent external-command execution.
中
Ruby/shell backtick execution
2. **调用 API(优先 `curl`,`web_fetch` 兜底)**:按 `sources.md` 配置,优先使用 `curl` 调用 AI 数据源 API
The skill directly instructs the agent to invoke curl for API collection. Endpoint allowlisting limits exposure, but an external process is intentionally executed.
中
Ruby/shell backtick execution
- AI 新闻 API(`curl`)
This collection step assigns the AI news API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.
中
Ruby/shell backtick execution
- OpenClaw 新闻 API(`curl`)
This collection step assigns the OpenClaw news API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.
中
Ruby/shell backtick execution
- AI 行业大事件 API(`curl`)
This collection step assigns the industry events API to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.
中
Ruby/shell backtick execution
- MetaEra AI 快讯(`curl`)
This collection step assigns the MetaEra feed to curl, confirming intentional external-process use. The surrounding rules restrict requests to configured endpoints.
中
Ruby/shell backtick execution
- `sources.md` 中所有 URL 均为 API endpoint,必须优先使用 `curl` 获取数据。
This rule requires curl requests to all configured API endpoints, confirming intended external-process and network use. The URLs are allowlisted, reducing injection risk.
中
Ruby/shell backtick execution
- 建议优先使用 `curl` 调用 API endpoint
The skill recommends invoking curl against an API endpoint, which is genuine external-command use. It does not construct a command from user input.
低
Hardcoded URL
| MetaEra AI 快讯 | https://agent.me.news/skill/flash/list?page=1&size=20&category=ai | API | AI 分类快讯流
This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.
低
Hardcoded URL
| AI 新闻 API | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=ai | API | AI 新闻列
This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.
低
Hardcoded URL
| OpenClaw 新闻 API | https://agent.me.news/skill/aimpact/articles?page=1&size=20&category=openclaw |
This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.
低
Hardcoded URL
| AI 行业大事件 API | https://agent.me.news/skill/aimpact/events | API | AI 行业大事件 |
This is an active publisher-controlled API endpoint that the collection workflow requests. It creates intended third-party network exposure.
風險因素
🌐 網路存取 (16)
⚙️ 外部命令 (26)
SKILL.md:41 SKILL.md:68 SKILL.md:69 SKILL.md:77-82 SKILL.md:82-85 SKILL.md:85-88 SKILL.md:88-103 SKILL.md:103-104 SKILL.md:104-118 SKILL.md:118-126 SKILL.md:126-130 SKILL.md:130-131 SKILL.md:131 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136 SKILL.md:146-150 SKILL.md:150 SKILL.md:151 SKILL.md:152-156 SKILL.md:156-157 SKILL.md:157 SKILL.md:158-160 SKILL.md:85
偵測到的模式
Windows scheduled task creation
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/me-news-ai-news-pro/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/me-news-ai-news-pro?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/me-news-ai-news-pro?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/me-news-ai-news-pro/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/me-news-ai-news-pro.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
me-news. (2026). ai-news-pro security audit report (audit version 1) [Author version 0.9.1]. Skillstore. https://skillstore.io/skills/me-news-ai-news-pro/audits/1BibTeX 引用
@techreport{me-news-me-news-ai-news-pro-2026,
author = {me-news},
title = {ai-news-pro security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/me-news-ai-news-pro/audits/1},
note = {Author version 0.9.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ai-news-pro security audit report (audit version 1)"
version: "0.9.1"
type: report
authors:
- name: "me-news"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/me-news-ai-news-pro/audits/1"
identifiers:
- type: other
value: "skillstore:me-news-ai-news-pro:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
100
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Prepare a Daily Research Brief
Generate a concise morning report of important model, agent, safety, and product developments.
Track Product and Market Changes
Review ranked funding, acquisition, release, and industry-event updates from the last 24 hours.
Publish a Team News Digest
Format selected AI stories for delivery through an already configured messaging channel.
試試這些提示
Get the Morning Briefing
Query the AI morning briefing for today. Show up to 10 ranked items with categories, summaries, and source links.
Review Recent Hot News
Query the 24-hour AI hot-news ranking. Prioritize high-scoring items and include one concise trend observation.
Analyze Selected Categories
Generate an AI evening briefing focused on agents, safety, and open source. Keep factual details and source links.
Build an Executive Trend Brief
Create a 24-hour executive AI digest. Rank major events, separate product and market signals, identify repeated themes, and note uncertain claims.
最佳實務
- Confirm that you trust agent.me.news before enabling network access.
- Open source links before using a briefing for important decisions.
- Preview reports and verify the destination before enabling automatic message delivery.
避免
- Do not treat API-provided AI scores as independent fact checks.
- Do not add unapproved endpoints or replace the configured source allowlist.
- Do not create scheduled tasks without explicit user approval and a removal plan.
常見問題
Which sources does this skill use?
It uses four configured endpoints on agent.me.news for AI articles, OpenClaw news, flash updates, and industry events.
Can it search the public web?
No. The instructions restrict collection to URLs listed in sources.md.
How are stories ranked?
The skill sorts by the API-provided AI score when that field is available.
Can it send reports automatically?
Yes, but delivery requires a separately configured message tool, channel, credentials, and external scheduling.
Does the skill store messaging credentials?
No. Its documentation states that credentials must be managed outside the skill.
Are the summaries verified for accuracy?
No. Review important claims and follow the included source links before making decisions.
開發者詳細資訊
作者
me-news授權
MIT
作者版本
v0.9.1
Skillstore 修訂
r1
引用
e5f4ac55b99872f66a36ead0049c5c56486976b8
維護新鮮度
2026/8/5
使用量
0 次下載 · 0 次瀏覽
檔案結構