安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (fetch paginated events from iYiou and render a daily Markdown report); nothing in the bundle indicates unexplained access or data exfiltration.
评估建议
What to consider before installing/running:
- This skill expects Node (the scripts are run with `node`); the skill metadata does not list Node as a required binary — ensure you run it in a compatible Node 18+ environment.
- The scripts only call the public iYiou API (https://api.iyiou.com/skill/info) and print reports to stdout; they do not write files or access other services or environment secrets.
- agents/openai.yaml enables implicit invocation; if you want to avoid the agent calling this sk...详细分析 ▾
ℹ 用途与能力
The skill name/description, SKILL.md, and included scripts all consistently implement fetching from https://api.iyiou.com/skill/info, normalizing and rendering reports. Minor inconsistency: the package metadata lists no required binaries, but the SKILL.md and scripts expect to be run with Node (the run commands call `node` and the scripts use ESM imports and global fetch). This is a small documentation/runtime mismatch but not an indication of malicious intent.
✓ 指令范围
Runtime instructions and the scripts confine actions to: HTTP GET requests to the declared iYiou API, JSON parsing, in-memory normalization/deduplication, and printing Markdown to stdout (or reading normalized JSON from stdin/file). The SKILL.md explicitly disables writing artifacts to disk. The code does not access unrelated system files, environment variables, or external endpoints beyond the iYiou API.
✓ 安装机制
There is no install spec (instruction-only install). The bundle includes scripts but does not download or extract external archives or install third-party packages at runtime. Risk is low, assuming you run the scripts in a trusted Node runtime.
✓ 凭证需求
The skill declares no required environment variables or credentials and the code does not read secret-bearing environment variables. Network access is necessary to call the public iYiou endpoint; no unrelated credentials or sensitive config paths are requested.
ℹ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. agents/openai.yaml sets allow_implicit_invocation: true (it permits the agent to invoke the skill implicitly), which is a normal configuration for useful skills but means the agent could call this skill autonomously when the prompt/system permits. This is not inherently malicious but is worth noting if you prefer only explicit invocation.
⚠ scripts/run_full_report.mjs:116
Shell command execution detected (child_process).
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/12
Daily Investment Digest 1.0.0 - Initial release of the daily-investment-digest skill. - Fetches investment/financing event lists from the iYiou API, paginated and deduplicated. - Generates a daily Markdown financing report printed to stdout, following strict output order and data mapping. - Defaults to yesterday’s events unless explicitly requested otherwise. - Robust error handling: retries, backoff, and page-level error reporting. - Does not write any files; all outputs are to stdout only.
● 无害
安装命令
点击复制官方npx clawhub@latest install daily-investment-digest
镜像加速npx clawhub@latest install daily-investment-digest --registry https://cn.longxiaskill.com
技能文档
Overview
- Pull investment/financing events from
https://api.iyiou.com/skill/info. - Normalize fields, deduplicate rows, and generate a structured Chinese daily report.
Workflow
- One-command full report (recommended, default uses yesterday).
node "{baseDir}/scripts/run_full_report.mjs" \
--max-page 5
- If user explicitly asks for today's report, pass today's date.
node "{baseDir}/scripts/run_full_report.mjs" \
--report-date 2026-03-11 \
--max-page 5
- Direct output mode (stdout only, no file).
node "{baseDir}/scripts/fetch_events.mjs" \
--report-date 2026-03-11 \
--stdout-json | \
node "{baseDir}/scripts/generate_report.mjs" \
--input-json - \
--top-n 0 \
--stdout
Path Safety
- Always call scripts with quoted
{baseDir}paths to avoid whitespace-path issues. - Scripts resolve relative input paths against the skill root directory.
Required API Rules
- Use
pageSize=10. - Start at
page=1. - Increment
pageby 1 each request. - Stop when
page>5or API event list is empty. - Parse response strictly by schema:
response.code->response.data.posts. - Treat non-zero
codeas API failure. - Retry failed requests up to 3 times before skipping a page.
Script Interfaces
scripts/run_full_report.mjs
- One-command pipeline: fetch + generate
- Defaults to full output (
top-n=0) - Supports
--report-date,--max-page,--page-size,--timeout-seconds,--retry,--delay-seconds - Supports
--top-n(0means all events)
scripts/fetch_events.mjs
--page-sizedefault10--max-pagedefault5--report-datedefault yesterday (YYYY-MM-DD)--timeout-secondsdefault15--retrydefault3--delay-secondsdefault0- Always prints JSON to stdout (
--stdout-jsonkept only for compatibility) - Numeric args are bounded for safety:
page-size[1,100],max-page[1,500],retry[1,10]
scripts/generate_report.mjs
--input-jsonrequired--top-ndefault0(0means all events)- Always prints report text to stdout (
--stdoutkept only for compatibility) - Numeric args are bounded for safety:
top-n[0,500]
Output Files
- Disabled by design. This skill is stdout-only and does not write report artifacts to disk.
Data Mapping
- Follow field_mapping.md for source-to-target mapping and fallback rules.
- To reduce context size, the fetch output keeps only:
brief,createdAt,originalLink,postTitle,tags.
Failure Handling
- Continue on single-page failure after retries.
- Use progressive retry backoff (
0.5s,1.0s,1.5s, ...). - Record page-level errors in output JSON
meta.errors. - Generate a report even when no events are found, and clearly mark it as an empty-day report.
Output Policy
- Date policy: default to yesterday; only use today when the user explicitly asks for today.
- If user asks full detail, run with
--top-n 0. - Use script stdout as the main body and keep event entries unchanged.
- Output order is mandatory:
- First output the full event list.
- Each event must include:
公司简称、轮次、投资方、事件摘要、来源链接. - After the full event list, append one ending section titled
投资事件总结. - Do not output
投资事件总结before event entries.
Quick Checks
- Run fetch step and confirm
meta.total_unique_events > 0on active days. - Run report step and confirm stdout contains:
核心数据概览融资事件按行业分类- In final AI response, confirm order:
- Event list appears first and each item includes
公司简称、轮次、投资方、事件摘要、来源链接. 投资事件总结appears only after the event list.投资事件总结appears exactly once at the end.- In final AI response, confirm it appends:
投资事件总结
Example End-to-End Command
node "{baseDir}/scripts/run_full_report.mjs" \
--report-date 2026-03-11 \
--max-page 5