db-ai-github-paper-weekly-news
抓取并分析"数据库、AI、GitHub、AI论文"相关的近1周内最新内容，分类汇总，输出图文并茂（含内置 Mermaid 图）的 Markdown 周报到当前项目的 markdown/ 目录。 覆盖数据源：PostgreSQL Weekly、Planet PostgreSQL、Planet PostGIS、PostgreSQL 官方新闻、PostgreSQL Git 提交记录、DuckDB 新闻、AI每日资讯（aibase.com、ai-bot.cn）、GitHub Trending（周榜）、HuggingFace 热门论文。 触发条件：用户提到"数据库周报"、"AI周报"、"GitHub 周报"、"AI 论文周报"、"db weekly"、"抓取本周数据库新闻"、"抓取本周AI动态"、"生成技术周报"、"帮我整理本周的数据库/AI/Github/论文动态"、"weekly news"、"weekly report"、"周刊"，或用户希望获取 DB/AI/GitHub/Paper 领域近期综合资讯时，必须使用本 skill。即使用户只说"帮我看看这周有什么技术大事"或"PostgreSQL 最近有什么新闻"，也应使用本 skill。
67
81%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 Skill 的运行时会通过 `web_fetch` / `web_search` 从多个公共网页（如 GitHub Trending、HuggingFace、Planet、DuckDB、AIBase、AI-Bot、PostgreSQL Weekly 等）抓取/钻取文章正文、标题与摘要，并将其内容用于 Step 5 的周报生成进入 LLM 上下文，从而存在“公网上的第三方正文作为自由文本被注入”的风险。
- Repository
- digoal/blog
- Commit
3b9c83d
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.