安全扫描
OpenClaw
可疑
medium confidenceThe skill largely matches a crypto-news aggregator, but its runtime instructions and README claim features and scripts that are missing or unimplemented and it encourages installing via npx (which would pull remote code) — these inconsistencies warrant caution.
评估建议
This skill appears to be a simple crypto news tool, but there are multiple mismatches between what the README/SKILL.md promises and the code included: subscription/sentiment scripts, a config folder and caching/scheduling are advertised but missing; the main news script uses mock data rather than fetching feeds, while the search script does fetch RSS from hardcoded sources. Before installing or running: 1) Don't run `npx @gztanht/newspulse` blindly — that will fetch remote code which may differ ...详细分析 ▾
ℹ 用途与能力
Name/description, required binaries (node/npm), package.json, and the two scripts (news.mjs, search.mjs) are consistent with a small crypto news aggregator. However many advertised features (push/subscribe, sentiment analysis scripts, config/sources.json editing, caching/update scheduler) are mentioned but not implemented in the included files. The funding/sponsorship addresses are present in README/SKILL.md but are unrelated to runtime needs (not an env var).
⚠ 指令范围
SKILL.md and README reference multiple scripts that do not exist in the bundle (subscribe.mjs, sentiment.mjs, sentiment commands, scripts_news.mjs typos) and instruct editing config/sources.json though there is no config directory included. The main news script is mock-data only (it doesn't fetch RSS), while search.mjs does fetch RSS from hardcoded sources. The instructions are therefore inconsistent and overly broad compared to the packaged code.
ℹ 安装机制
The registry entry contains no install spec (lowest platform risk) but SKILL.md tells users to run `npx @gztanht/newspulse`. Running that outside this platform would download and run a package from the npm registry — a different code path than the embedded files. This is not inherently malicious but is a behavioral inconsistency and an operational risk if the remote package differs from the bundled code.
✓ 凭证需求
The skill requests no environment variables or credentials and does not reference any sensitive config paths. The only potentially sensitive artifacts are blockchain sponsorship addresses in README/SKILL.md, which are informational and not used by the code.
✓ 持久化与权限
Skill flags are normal (always:false, model invocation enabled). It does not request permanent presence or modify other skills or system-wide settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.32026/3/6
● 无害
安装命令 点击复制
官方npx clawhub@latest install newspulse
镜像加速npx clawhub@latest install newspulse --registry https://cn.clawhub-mirror.com
技能文档
Stay Ahead of the Market - 不错过任何重要事件!
Overview
NewsPulse 聚合全球主流加密货币新闻源(CoinDesk, Cointelegraph, TheBlock, Decrypt 等),提供实时新闻推送、重要事件提醒、社交媒体情绪分析等功能。
Features
- 📰 新闻聚合 - 10+ 主流加密媒体实时抓取
- 🔔 重要事件 - 监管政策、交易所上线、黑客事件等即时推送
- 📊 情绪分析 - 新闻情绪评分(正面/中性/负面)
- 🏷️ 分类筛选 - 按币种/主题/重要性筛选
- ⏰ 时间线 - 24h/7d/30d 新闻回顾
- 🌐 多语言 - 英文/中文新闻支持
Installation
npx @gztanht/newspulse
Usage
查看最新新闻
# 最新 10 条新闻
node scripts/news.mjs --limit 10# 比特币相关新闻
node scripts/news.mjs --tag btc
# 重大事件(高重要性)
node scripts_news.mjs --importance high
# 负面新闻预警
node scripts/news.mjs --sentiment negative
设置新闻推送
# BTC 相关新闻推送
node scripts/subscribe.mjs --tag btc# 监管政策新闻
node scripts/subscribe.mjs --tag regulation
# 查看已订阅
node scripts/subscribe.mjs --list
情绪分析
# 查看 24h 新闻情绪
node scripts/sentiment.mjs --period 24h# 特定币种情绪
node scripts/sentiment.mjs --tag eth
News Sources
- CoinDesk
- Cointelegraph
- The Block
- Decrypt
- Bitcoin Magazine
- Ethereum World News
- CryptoSlate
- U.Today
- NewsBTC
- AMBCrypto
Configuration
编辑 config/sources.json 自定义新闻源:
{
"sources": [
{"name": "CoinDesk", "url": "https://coindesk.com/feed", "enabled": true},
{"name": "Cointelegraph", "url": "https://cointelegraph.com/rss", "enabled": true}
]
}
API Reference
- RSS Feed 抓取 - 各新闻源官方 RSS
- 更新频率 - 每 5-15 分钟
- 缓存 - 本地缓存 1 小时
Support
- 📧 Email: Support@NewsPulse.shark
- 💬 Telegram: @NewsPulseBot
- 🦈 赞助:USDT (ERC20):
0x33f943e71c7b7c4e88802a68e62cca91dab65ad9
License
MIT © 2026 gztanht
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制