Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

auto-diary

v1.0.2

Automatically write daily/weekly/monthly diary summaries and extract insights to auto-learn.md for HexaLoop.

0· 74·0 current·0 all-time
byJialin@0xcjl
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (auto-diary for HexaLoop) matches the included scripts and SKILL.md: scripts read workspace memories, farm.json and NOW.md, generate diary Markdown, append insights to auto-learn.md, and produce Feishu card JSON. The code and instructions are generally consistent with the stated purpose.
Instruction Scope
Runtime instructions and scripts operate only on user workspace paths (~/.openclaw/workspace) and generate/save diary/insights and card JSON. They do not attempt to read unrelated system paths or environment variables beyond the workspace, and the workflow is narrowly scoped to diary generation and aggregation.
Install Mechanism
No install spec (instruction-only) and no external downloads — low install risk. However, the skill package includes multiple Python scripts and templates (they will be placed on disk as part of the skill package). There are no remote installers or URL downloads.
!
Credentials
SKILL.md and code intend to 'push' Feishu interactive cards to a specific chat_id, but requires.env lists no Feishu credentials and no token/env var is declared. The code builds card JSON but does not perform network auth or send — it relies on an external function (feishu_im_user_message) or platform-provided Feishu tool that is not documented in the skill. This is an incoherence: sending messages to Feishu normally requires credentials or an SDK, yet none are requested or handled.
Persistence & Privilege
always is false and the skill does not request elevated platform privileges. It writes only to its own workspace subpaths (~/.openclaw/workspace/memory/diary and auto-learn.md) and does not modify other skills or system config.
What to consider before installing
What to check before installing: - Feishu integration: The skill specifies a Feishu chat ID and shows how to format an interactive card, but it does not provide or request any Feishu API token or credentials. Confirm how your platform supplies feishu_im_user_message or Feishu credentials (e.g., a platform tool or pre-configured token). If no platform tool exists, the skill cannot actually send messages as-is — or it may expect you to add secrets later. Treat this as a mismatch and verify explicitly. - File writes: The skill will read and write files under ~/.openclaw/workspace (memory/*.md, auto-learn.md, farm/farm.json). Ensure you are comfortable with these paths being read and modified by the skill and that no sensitive data resides there. - Network behavior: The included scripts build Feishu card JSON but do not themselves perform authenticated network requests. Ask whether your agent runtime provides a trusted Feishu send function; if not, review/send code that performs network calls before enabling the skill. - Review content and parsing: Extraction functions are simple string parsers and may mis-parse or include unexpected content; inspect templates and outputs to ensure no sensitive fields will be accidentally appended to auto-learn.md. - If you need higher assurance: request the skill author to (1) declare required env vars (e.g., FEISHU_TOKEN or platform tool access) and (2) either implement an explicit, auditable send routine or clearly document the platform service that will handle message delivery. With that information the incoherence would be resolved and confidence would rise.

Like a lobster shell, security has layers — review code before you run it.

auto-diaryvk976bmccv4vm7d5w9patjv9ah583z9rbbilingualvk976bmccv4vm7d5w9patjv9ah583z9rbdaily-diaryvk976bmccv4vm7d5w9patjv9ah583z9rbfeishuvk976bmccv4vm7d5w9patjv9ah583z9rbhexaloopvk976bmccv4vm7d5w9patjv9ah583z9rblatestvk975m2qsprfs3q2b4h74g2n8rd83z47amonthly-reviewvk976bmccv4vm7d5w9patjv9ah583z9rbopenclaw-skillvk976bmccv4vm7d5w9patjv9ah583z9rbweekly-reviewvk976bmccv4vm7d5w9patjv9ah583z9rb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments