Sec Daily Digest

Generate a daily cybersecurity digest for researchers from CyberSecurityRSS OPML feeds and Twitter/X security KOL accounts.
Trigger command: /sec-digest.

When to Use

• - The user asks for a daily or latest cybersecurity digest.
• The user needs balanced AI + security coverage from RSS feeds.
• The user wants Twitter/X KOL security updates alongside RSS content.
• The task needs merged vulnerability events (CVE-first + non-CVE clustering).
• The user requests provider control (openai|gemini|claude|ollama) or --dry-run.

When Not to Use

• - The user wants ad-hoc one-off article summaries (use direct summarization instead).
• The user expects arbitrary output language switching.

Quick Start

CODEBLOCK0

CLI Flags Reference

Quick Reference

• - Entrypoint: INLINECODE22
• Pipeline: INLINECODE23
• Config root: INLINECODE24
• Config file: INLINECODE25
• Sources file: INLINECODE26
• Health file: INLINECODE27
• Archive dir: INLINECODE28
• OPML cache (tiny): INLINECODE29
• OPML cache (full): INLINECODE30

Required Behavior

1. 1. Always perform OPML remote update check before feed parsing.
2. If OPML remote check fails, use local cache only when cache exists.
3. If remote check fails and no local cache exists, fail fast (No cached OPML available and remote update check failed.).
4. Provider defaults to openai; explicit --provider overrides config.
5. Ranking uses balanced weights (Security + AI, default 0.5/0.5).
6. Output sections must include AI发展, 安全动态, and 漏洞专报.
7. INLINECODE38 exists in config, but current implementation outputs fixed bilingual-style markdown; do not assume runtime language switching.
8. Twitter KOL section (🔐 Security KOL Updates) appears only when tweets are fetched.
9. Twitter fetch is silently skipped (no crash) when no credentials are present.

Twitter/X Configuration

Twitter KOL accounts are configured in ~/.sec-daily-digest/sources.yaml (auto-created on first run with 15 default security researchers).

Default KOL List

Taviso, GossiTheDog, SwiftOnSecurity, MalwareTechBlog, briankrebs, JohnLaTwC, and 9 others.

sources.yaml Format

CODEBLOCK1

Backend Selection

Archive (Historical Dedup)

Articles seen in the past 7 days receive a −5 score penalty (not removed, just deprioritized). Archive files are stored in ~/.sec-daily-digest/archive/YYYY-MM-DD.json and automatically cleaned after 90 days.

Source Health Monitoring

Each run records fetch success/failure for every source. Sources failing >50% of checks (with ≥2 checks) appear in a ⚠️ Source Health Warnings section at the bottom of the digest. Health data lives in ~/.sec-daily-digest/health.json.

Email Delivery (gog)

The --email flag sends the digest via gogcli:

CODEBLOCK2

Log output:
CODEBLOCK3

Full Text Enrichment

INLINECODE49 fetches article full text before AI scoring (improves classification and summarization quality). Skips paywalled/social domains (Twitter, Reddit, GitHub, YouTube, NYT, Bloomberg, WSJ, FT).

cron Integration

CODEBLOCK4

Common Mistakes

1. 1. Missing API key for selected provider (OPENAI_API_KEY is required, GEMINI_API_KEY is required, ANTHROPIC_API_KEY is required).
2. Misreading fallback behavior: OPML fallback is cache-dependent, not unconditional.
3. Forgetting --dry-run when no provider credentials are available.
4. Expecting Twitter KOLs without setting TWITTERAPI_IO_KEY or X_BEARER_TOKEN.

Success Signals

1. 1. Logs include [sec-digest] provider=..., [sec-digest] cache_fallback=true|false, [sec-digest] output=..., and [sec-digest] stats feeds=... articles=... recent=... selected=... vuln_events=... twitter_kols=....
2. Output markdown contains the three required sections and vulnerability references.
3. INLINECODE60 is written after each run.
4. INLINECODE61 is updated after each run.

More Detail

For full installation and extended usage notes, see README.md and README.zh-CN.md.