LifeLog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can read or update the Notion database shared with the integration token.

Why it was flagged

The skill requires a Notion integration token and database ID. This is expected for writing life logs to Notion, but it grants access to the connected Notion database.

Skill content
credentials:\n  required:\n    - NOTION_KEY\n    - NOTION_DATABASE_ID
Recommendation

Use a dedicated Notion integration shared only with the intended LifeLog database, prefer environment variables or a secret store, and revoke the token if you uninstall the skill.

What this means

Qualifying messages can create or update pages in the configured Notion database without a separate confirmation for each entry.

Why it was flagged

The script mutates Notion pages to append or create life-log records. This matches the purpose, but it is still third-party account data modification.

Skill content
RESULT=$(curl -s -X PATCH "https://api.notion.com/v1/pages/$PAGE_ID"
Recommendation

Install only if you want automatic Notion logging; use a dedicated database and keep backups if the diary content is important.

What this means

Personal diary text may be processed by the agent or configured model provider as part of date recognition and summary analysis.

Why it was flagged

The skill directs a SubAgent to inspect user messages for date classification. This is purpose-aligned, but it means private message content may cross an agent/model boundary.

Skill content
**立即调用 SubAgent 判断日期** - 分析消息中的日期关键词(今天/昨天/前天/具体日期)和上下文
Recommendation

Confirm you are comfortable with the configured model/provider handling diary text, especially if entries include sensitive personal details.

What this means

Stored diary entries can be reused in later summaries and may contain private information about emotions, locations, and people.

Why it was flagged

The daily-summary script retrieves stored diary text and emits it for later LLM analysis. Persistent personal context is expected for a life-log skill, but it should be treated as sensitive.

Skill content
echo "---原文开始---"\necho "$ORIGINAL"\necho "---原文结束---"
Recommendation

Keep the Notion database private, avoid storing secrets in diary entries, and do not treat stored diary text as trusted instructions for unrelated tasks.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If enabled, the skill can continue running a daily summary workflow after initial setup.

Why it was flagged

The skill documents an optional scheduled daily job. It is disclosed and user-initiated, but it creates ongoing background automation.

Skill content
openclaw cron add \\\n  --name "LifeLog-每日汇总" \\\n  --cron "0 5 * * *"
Recommendation

Only add the cron job if you want ongoing automation, and periodically review or remove it with OpenClaw cron management commands.