PsyClaw ISI

Structured screening for insomnia severity using the ISI scale, requiring psyclaw-openclaw-health installation or local credentials.

Security Scan

The skill's stated purpose (ISI screening) is plausible and mostly coherent, but the runtime instructions rely on external credentials, config paths, and environment variables that are not declared — this mismatch warrants caution.

Purpose & Capability

Name and description match the included assessment content (isi.md) and the workflow (fetch definition, answer locally, submit JSON). It sensibly references an integration with a 'psyclaw-openclaw-health' component, which could legitimately provide platform endpoints and credentials.

Instruction Scope

SKILL.md and isi.md instruct the agent to call a platform API and to POST results to $AGENT_PLATFORM_BASE_URL with a Bearer token, and to use a local credentials.json path (.agents/skill-docs/openclaw-health/credentials.json). Those required runtime variables/paths are not declared in the skill metadata, so the instructions ask the agent to read/send secrets or config that were not listed as required.

Install Mechanism

There is no install spec (instruction-only), which is low risk. However the README suggests using 'npx clawhub install/update psyclaw-openclaw-health' — that implies Node/npm will be used and may pull external packages; the skill metadata did not declare that dependency.

Credentials

The instructions expect an AGENT_PLATFORM_BASE_URL and an agent API key (Bearer <YOUR_AGENT_API_KEY>) and optionally a local credentials.json, but the skill declares no required env vars or config paths. Asking for platform URL and an API key is reasonable for a submission flow, but the omission from requires.env and required config paths is an incoherence and could lead to accidental credential exposure if the agent looks in unexpected places.

Persistence & Privilege

The skill does not request persistent/always-on presence and keeps normal invocation settings (always: false). It does not attempt to modify other skills or system-wide agent settings in the provided instructions.

What to consider before installing

This skill appears to implement the ISI screening flow and to expect a platform endpoint and agent API key for submitting results, but those secrets and a credentials file are referenced in the instructions yet not declared in the skill metadata. Before installing or enabling: (1) confirm where AGENT_PLATFORM_BASE_URL and the required API key should come from and only provide least-privilege credentials; (2) inspect the psyclaw-openclaw-health skill (or its credentials.json) before installing to ensure you trust that source; (3) be aware the SKILL.md suggests running 'npx' which will download packages — run such commands in a controlled environment if you must; (4) avoid supplying high-privilege tokens to the skill and verify the exact endpoint domain where results will be POSTed. If you need higher assurance, ask the publisher for the upstream skill's source or run the skill in a sandboxed agent.

这是 ISI 的独立 ClawHub skill，用于失眠严重度的结构化筛查。

前置条件：

• 最好已经安装 psyclaw-openclaw-health
• 或者你本地已经有可用的 .agents/skill-docs/openclaw-health/credentials.json

使用方式：

• 阅读同目录下的 isi.md
• 按协议完成量表评分并提交结果

如果你还没有完成主接入流程，请先安装：

npx clawhub update psyclaw-openclaw-health --force || npx clawhub install psyclaw-openclaw-health --force