English Learn Cards

Flashcard-based English vocabulary learning with SQLite + SRS. Works with any chat platform when paired with an OpenClaw agent prompt.

Security Scan

The skill appears to implement the advertised flashcard/SRS functionality, but packaging is incomplete (no install spec or declared runtime dependencies) and the helper script makes outbound network requests — review before installing or running.

Purpose & Capability

Name/description (SQLite + SRS flashcards) matches included code and SKILL.md: the script manages a local SQLite DB, supports SRS grading, and has commands for adding/rendering/grading cards.

Instruction Scope

SKILL.md binds DB path via ENGLISH_LEARN_CARDS_DB and instructs use of the included helper CLI. The Python helper performs HTTP requests (e.g., to dictionary.cambridge.org) to fetch audio when --fill-audio is used — this is coherent with the audio feature but does mean the skill will contact third-party hosts.

Install Mechanism

There is no install spec despite inclusion of a ~30KB Python script that imports requests and requires Python to run. The registry metadata lists 'required binaries: none' but the helper CLI requires python (and the requests package). Missing declared dependencies / install steps is an incoherence and a usability/security risk.

Credentials

The skill requests no secrets and only optionally uses ENGLISH_LEARN_CARDS_DB to control a local DB path (defaulting to ~/clawd/memory/...). This is proportionate for a local flashcard tool.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform-level privileges. It writes a local SQLite DB in a user-writable path (by default under the user's home).

What to consider before installing

This skill's code and instructions are generally consistent with a local flashcard tool, but take these precautions before installing or running it: - Inspect the full scripts/words.py file yourself (it makes outbound HTTP calls to fetch audio and may call other third-party endpoints). - The package did not declare runtime requirements: you will need Python and the 'requests' library; run the script in a virtual environment (venv) and avoid running as a privileged user. - If you don't want network access, avoid using --fill-audio or run in an offline/sandboxed environment; check which domains the script contacts (Cambridge dictionary is visible in the source). - Ensure the DB path (ENGLISH_LEARN_CARDS_DB) points to a safe, non-sensitive location; do not set it to a system or secrets-related folder. - Because there is no install spec, the environment won’t automatically install dependencies — the missing declaration is an incoherence and increases risk; prefer skills that list install steps or include explicit dependency manifests. If you want to proceed: run the script in an isolated environment, review network calls, and consider adding a small install script that pins and installs required Python packages before use.

English Learn Cards (SQLite + SRS)

A portable vocabulary flashcard workflow for OpenClaw.

• Stores cards in SQLite
• Supports SRS reviews (0–3 grading, SM-2–like)
• Uses a deterministic helper CLI (scripts/words.py) to avoid flaky formatting

Platform notes

This skill is platform-agnostic (Slack/Discord/WhatsApp/Telegram/etc.). Your channel-specific agent prompt should decide:

• message formatting (bullets/headers)
• quiz flow UX
• how user answers are parsed

A ready-to-copy prompt template lives in:

• skill/prompt-examples/AGENT_PROMPT_TEMPLATE.md

Storage

• SQLite DB path is controlled via env var:
  • ENGLISH_LEARN_CARDS_DB (default: ~/clawd/memory/english-learn-cards.db)

Helper CLI (required)

Use the helper for all DB operations:

python skill/scripts/words.py init
python skill/scripts/words.py migrate
python skill/scripts/words.py add "implement" ...
python skill/scripts/words.py render "implement" --fill-audio
python skill/scripts/words.py due
python skill/scripts/words.py grade <card_id> <0-3>

Safety / publishing

Do not commit:

• your SQLite DB
• secrets / tokens
• one-off migration/enrichment scripts

Keep local-only scripts outside the repo (see .gitignore).