Capacities
v1.0.0Manage Capacities notes, daily entries, and weblinks.
⭐ 1· 1.7k·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description say 'Manage Capacities notes, daily entries, and weblinks' and the SKILL.md contains curl calls to https://api.capacities.io using a CAPACITIES_API_TOKEN. The requested credential (CAPACITIES_API_TOKEN) is appropriate and proportionate for that purpose.
Instruction Scope
Instructions are limited to making HTTP requests (curl) to capacities.io endpoints for saving daily notes, weblinks, lookups, and space-info. They do not instruct reading local files or unrelated system state. However, the SKILL.md references an optional CAPACITIES_SPACE_ID environment variable that is not declared in the skill metadata, and there are minor inconsistencies in parameter naming (e.g., spaceId vs spaceid).
Install Mechanism
No install spec and no code files — this is instruction-only, so nothing is written to disk or fetched at install time.
Credentials
The declared primaryEnv is CAPACITIES_API_TOKEN which makes sense. But the SKILL.md expects an additional CAPACITIES_SPACE_ID (optional) that is not listed in requires.env. The skill does not request unrelated credentials, however the undeclared env var is a mismatch that should be corrected/clarified.
Persistence & Privilege
always is false and there are no instructions to persist configuration or modify other skills or system settings. The skill could be invoked autonomously (platform default), which is expected for skills of this type.
Assessment
This skill appears to simply call the Capacities API and only needs your Capacities API token — that is coherent with its description. Before installing: 1) Confirm the CAPACITIES_API_TOKEN you provide is a purpose-limited token and not reused for other services. 2) Note the SKILL.md mentions an optional CAPACITIES_SPACE_ID env var but the skill metadata doesn't declare it—if you rely on a specific space, set that env var explicitly or ask the publisher to update the metadata. 3) Verify the endpoints (api.capacities.io) and parameter names against official Capacities docs if possible. 4) The publisher/source is unknown; if you don't trust the publisher, avoid supplying a high-privilege token. If the SKILL.md were to request unrelated credentials, read local files, or include external install/download steps, treat it as suspicious and do not install.Like a lobster shell, security has layers — review code before you run it.
latestvk976w3tt8ra2w4q1pta40vvrgs80d1t3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
EnvCAPACITIES_API_TOKEN
Primary envCAPACITIES_API_TOKEN