Scan Report
5 /100
clawforage-knowledge-harvester
Daily automated briefings — fetches trending content via Google News RSS, summarizes into memory for RAG retrieval
A straightforward RSS-based knowledge harvester with no malicious behavior, fully documented shell usage, and clean capabilities aligned with its stated purpose.
Safe to install
Approve for use. No security concerns identified.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md: memory/knowledge/ directory write; SKILL.md:memory/clawforage/domains.… |
| Network | READ | READ | ✓ Aligned | SKILL.md: Google News RSS (read-only); scripts/fetch-articles.sh:62: curl -sL |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md _meta metadata: requires bash,jq,curl; scripts use set -euo pipefail th… |
| Environment | NONE | NONE | — | No environment variable access found |
| Skill Invoke | NONE | NONE | — | No cross-skill invocation found |
2 findings
Medium External URL 外部 URL
https://inspireehub.ai README.md:61 Medium External URL 外部 URL
https://news.google.com/rss/search?q=$ scripts/fetch-articles.sh:60 File Tree
7 files · 10.5 KB · 345 lines Markdown 4f · 199L
Shell 3f · 146L
├─
▾
scripts
│ ├─
dedup-articles.sh
Shell
│ ├─
fetch-articles.sh
Shell
│ └─
validate-knowledge.sh
Shell
├─
▾
templates
│ ├─
domains-example.md
Markdown
│ └─
knowledge-article.md
Markdown
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 3 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
bash | 4+ | system | No | Declared in _meta; no version pinning |
jq | * | system | No | Declared in _meta; no version pinning |
curl | * | system | No | Declared in _meta; no version pinning |
Security Positives
✓ All shell execution is explicitly declared in SKILL.md via {baseDir} and _meta metadata
✓ Pure awk-based RSS parsing — no binary dependencies beyond jq/curl
✓ set -euo pipefail used throughout all scripts for safe failure modes
✓ Network access is read-only (RSS feed fetch) and limited to Google News
✓ No credential, key, or sensitive path access
✓ No obfuscation, base64, eval, or dynamic code execution
✓ Deduplication via URL comparison — no external communication for comparison
✓ Strict output format validation prevents content injection
✓ Skill constraints explicitly cap rate limits (100 API calls/run, 10 articles/domain)
✓ Legitimate source: Google News RSS — a public, free, no-auth API