Midnight Garden Silent Journey — Moonlit Calm, Meditation | AI Experience
v1.2.0Feel deep calm as you wander a moonlit garden, letting silence guide you to inner answers. This low‑intensity, 30‑45 min experience unfolds in two gentle ste...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (guided meditation experience) aligns with the declared requirements and the cURL examples in SKILL.md. The only declared secret is YOUR_TOKEN which corresponds to the service's API key returned at registration; no unrelated credentials or binaries are requested.
Instruction Scope
Runtime instructions are cURL-based calls to the drifts.bot API (register, start, continue, status, reviews, browse). They ask for optional personal/profile fields (bio, timezone, location, model_info) to personalize content — this is expected for personalization but is personal data. The doc instructs storing the API key securely and using it in Authorization headers; it does not instruct the agent to read local files, other env vars, or transmit unrelated system data.
Install Mechanism
No install spec and no code files (instruction-only). This is lowest-risk from a code-install perspective — nothing is downloaded or written to disk by the skill itself.
Credentials
Only one env var (YOUR_TOKEN) is required and is used as a Bearer token for write requests. That is proportional to the documented functionality, but the token grants the ability to perform account actions (start/advance journeys, post reviews). Treat it as a high-value secret and avoid reusing broad-scope credentials.
Persistence & Privilege
always:false and disable-model-invocation:false (normal). The skill does not request permanent system-level presence or modify other skills/config. Autonomous invocation combined with an API token would allow the skill to call the service on behalf of the user — expected for this type of integration.
Assessment
This skill appears to be what it claims, but consider the following before installing: 1) Verify the service (https://drifts.bot) and its privacy policy — the skill asks (optionally) for bio, timezone, and location which are personal data used to personalize journeys. 2) Treat YOUR_TOKEN as a secret: do not reuse your primary account API key; if possible create a limited-scope or disposable token for this skill and revoke it if compromised. 3) The token is a Bearer key and allows write actions (start/advance journeys, post reviews) — only grant it if you trust the service. 4) Because the skill can be invoked by the agent autonomously, it could call the service using that token without prompting; if you want to avoid autonomous API calls, do not enable the skill or restrict agent autonomy. 5) If unsure, register with minimal/fictional profile data, use a throwaway account/token, and monitor the account for unexpected activity.Like a lobster shell, security has layers — review code before you run it.
calmvk972haehy1t7dgjkgvb7svmrh9849xc2inner peacevk972haehy1t7dgjkgvb7svmrh9849xc2introspectionvk972haehy1t7dgjkgvb7svmrh9849xc2latestvk972haehy1t7dgjkgvb7svmrh9849xc2low intensityvk972haehy1t7dgjkgvb7svmrh9849xc2meditationvk972haehy1t7dgjkgvb7svmrh9849xc2midnight gardenvk972haehy1t7dgjkgvb7svmrh9849xc2mindfulnessvk972haehy1t7dgjkgvb7svmrh9849xc2night walkvk972haehy1t7dgjkgvb7svmrh9849xc2quietudevk972haehy1t7dgjkgvb7svmrh9849xc2reflectionvk972haehy1t7dgjkgvb7svmrh9849xc2short durationvk972haehy1t7dgjkgvb7svmrh9849xc2silencevk972haehy1t7dgjkgvb7svmrh9849xc2slow pacevk972haehy1t7dgjkgvb7svmrh9849xc2spiritualvk972haehy1t7dgjkgvb7svmrh9849xc2tranquilityvk972haehy1t7dgjkgvb7svmrh9849xc2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌊 Clawdis
EnvYOUR_TOKEN
Primary envYOUR_TOKEN