Friends DB

Query and maintain Alex's local friends database stored in a private SQLite file under the OpenClaw workspace. Use when looking up a friend, finding phone/em...

Security Scan

The skill's code, instructions, and resource access are coherent with a local friends CRM: it reads/migrates friends.md, manages a private SQLite DB in the OpenClaw workspace, and exposes search/update commands; nothing obvious is disproportionate, but the sync-calendar/subprocess behavior should be reviewed before use.

Purpose & Capability

Name/description match the shipped script and assets. The script operates on a local SQLite DB in the OpenClaw workspace and provides search, show, CRUD, and migration commands — all consistent with a 'friends DB' helper. No unrelated services or credentials are requested.

Instruction Scope

SKILL.md restricts operations to the helper script and points to specific CLI commands (migrate, search, show, set-*, log-interaction, sync-calendar). It reads the workspace friends.md and the local DB. One caveat: sync-calendar and the script import subprocess (truncated portion not fully visible) — this suggests the script may call external calendar tooling or shell commands. That behavior is within scope if used to read calendar events, but you should review exactly what sync-calendar does and what subprocess calls it makes to ensure it doesn't call unexpected network endpoints or shell out with unsanitized input.

Install Mechanism

No install spec; this is instruction-only with a bundled Python script and JSON asset. No downloads, package installs, or archive extraction are performed by the skill metadata.

Credentials

No required environment variables or credentials are declared. The script reads optional env vars (OPENCLAW_WORKSPACE, OPENCLAW_FRIENDS_DB_DIR, OPENCLAW_FRIENDS_CALENDAR_ACCOUNT/ID/TIMEZONE) that are directly relevant to configuring where the DB and calendar account live. No unexpected secret access is requested.

Persistence & Privilege

always is false and the skill does not request elevated platform privileges. It creates and writes a private DB under the workspace and enforces 0700/0600 permissions for dirs/files. It does not modify other skills or global agent settings.

Assessment

This skill appears to do what it claims: manage a local, private friends SQLite DB and migrate from friends.md. Before installing or invoking it: 1) Inspect the remainder of scripts/friends_db.py (the truncated portion) to confirm what sync-calendar does and whether any subprocess calls contact external servers or execute shell commands with user-provided strings. 2) Expect the skill to create a hidden DB under your OpenClaw workspace (it sets restrictive filesystem permissions). If you plan to use calendar sync, confirm how credentials are obtained (it does not declare required credentials in metadata). 3) Run it in a controlled environment (or review the code line-by-line) if you have sensitive data in your workspace. Overall coherence is good, but review the subprocess/calendar code to raise confidence to high.

Use the helper script in scripts/friends_db.py. Do not run arbitrary SQL.

When to use

• A request depends on friend/contact details that used to live in friends.md
• You need a phone number, email, preferred name, or relationship note
• You need to track friendship cadence, last-seen dates, or activity ideas
• You need to add or update a friend fact after a conversation or event
• You need to sync past in-person interactions from calendar into the friend CRM

Commands

Initialize or migrate:

python3 ./skills/friends-db/scripts/friends_db.py migrate --source "$HOME/.openclaw/workspace/friends.md" --replace-with-stub

Search:

python3 ./skills/friends-db/scripts/friends_db.py search "lily"
python3 ./skills/friends-db/scripts/friends_db.py list

Show one contact:

python3 ./skills/friends-db/scripts/friends_db.py show "Lily Li"
python3 ./skills/friends-db/scripts/friends_db.py show "[e-mail]"

Friend CRM overview:

python3 ./skills/friends-db/scripts/friends_db.py due-list
python3 ./skills/friends-db/scripts/friends_db.py due-list --status all --within-days 14
python3 ./skills/friends-db/scripts/friends_db.py profile "David Su"
python3 ./skills/friends-db/scripts/friends_db.py suggest "David Su"

CRM setup and updates:

python3 ./skills/friends-db/scripts/friends_db.py set-importance "David Su" high
python3 ./skills/friends-db/scripts/friends_db.py set-cadence "David Su" 21
python3 ./skills/friends-db/scripts/friends_db.py set-context "David Su" --home-area "South Bay" --best-times "weekday evenings"
python3 ./skills/friends-db/scripts/friends_db.py add-tag "David Su" interest pickleball
python3 ./skills/friends-db/scripts/friends_db.py add-tag "David Su" neighborhood "South Park"

Interaction logging:

python3 ./skills/friends-db/scripts/friends_db.py log-interaction "David Su" --type in_person --at 2026-03-15T18:30:00-07:00 --location "South Park"
python3 ./skills/friends-db/scripts/friends_db.py sync-calendar --days-back 180

General contact updates:

python3 ./skills/friends-db/scripts/friends_db.py add-fact "Lily Li" "Invited to dinner on 2026-03-20"
python3 ./skills/friends-db/scripts/friends_db.py set-method "David Su" phone "[phone]" --primary
python3 ./skills/friends-db/scripts/friends_db.py set-preferred-name "Lily Li" "Lily"

Rules

• Keep the database in the hidden OpenClaw workspace state directory created by the helper.
• The helper enforces private filesystem permissions and parameterized SQL. Keep using it instead of shelling out to sqlite3 with raw user text.
• Treat friends.md as a stub only after migration. The database is the source of truth.
• sync-calendar uses attendee email first, then title/description alias matches.
• Count only in_person interactions toward the cadence target. Calls/texts/emails are supporting context.
• Cadence defaults: high=20, medium=30, low=90 days.
• Suggestions are local and deterministic; they come from tags plus the bundled activity template asset.
• Return only the fields needed for the task. Do not dump the whole contact database into chat unless Alex explicitly asks.