by 安全扫描
OpenClaw
安全
high confidenceThe skill appears to do what it claims (call a public Sell The News MCP endpoint for read-only news/tools); the included scripts call that endpoint and there's no secret access or obfuscated behavior, though a couple of minor mismatches (undeclared required binaries and an optional override env var) are worth noting.
评估建议
This skill is coherent and appears to only fetch read-only news/analysis from https://mcp.sellthenews.org/mcp (or an endpoint you set via SELL_THE_NEWS_MCP_ENDPOINT). Before installing, confirm you trust that endpoint and are comfortable allowing outbound HTTP calls. Ensure curl and python3 are available in the runtime environment (the scripts depend on them). Do not pass secrets or sensitive local data as tool arguments—the wrappers will send whatever JSON you provide to the remote MCP endpoint...详细分析 ▾
ℹ 用途与能力
The skill's name/description align with the code: the scripts call a Sell The News MCP endpoint to fetch news/analysis. Minor mismatch: the skill requires curl and python3 at runtime (used in scripts) but the registry metadata declared no required binaries.
✓ 指令范围
SKILL.md and the bundled wrappers limit activity to initializing an MCP session and calling read-only tools on the remote endpoint. Instructions do not instruct reading arbitrary local files or exfiltrating unrelated data. The wrappers parse SSE-style responses and print JSON.
✓ 安装机制
No install step (instruction-only with shipped scripts) — nothing is downloaded or extracted at install time. The included shell and Python code is small and readable with no obfuscation or hidden endpoints beyond the documented endpoint.
ℹ 凭证需求
No required credentials are requested (Auth: none). The code does accept an optional environment override SELL_THE_NEWS_MCP_ENDPOINT to change the endpoint, but that env var was not documented in the registry metadata; ensure this is intentional. Also note that runtime requires curl and python3 even though they weren't declared as required binaries.
✓ 持久化与权限
always is false and the skill does not request persistent system-wide changes or modify other skills. It only performs outbound HTTP calls when invoked.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/4/16
Fix wrapper execution after ClawHub install by invoking the core script via bash instead of relying on preserved executable bits.
● 无害
安装命令
点击复制官方npx clawhub@latest install sell-the-news
镜像加速npx clawhub@latest install sell-the-news --registry https://cn.longxiaskill.com