Quotes
v1.0.0Build a personal quotes system for saving, discovering, and automatically surfacing meaningful words.
⭐ 2· 939·0 current·0 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description (personal quotes system) align with the SKILL.md: it defines a ~/quotes workspace, collection files, tagging, discovery, favorites, and delivery rules. Nothing requested (no env vars, no binaries) is unexpected for a local quotes manager.
Instruction Scope
Most instructions are limited to creating and managing files under ~/quotes and are appropriately scoped. However, the 'Automated Delivery' section ('Automatically send quotes based on schedule/criteria', 'Channel: notification') is underspecified and could instruct the agent to use external notification channels or platform APIs. 'Ask/infer author' and 'verify when possible' imply network verification or web searches. These open-ended directives grant the agent broad discretion to access network services or system notification interfaces without declaring needed credentials or limits.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk installation footprint (nothing is written to disk by an installer beyond what the agent itself may do at runtime).
Credentials
The skill requests no environment variables, no credentials, and only specifies creating ~/quotes. That is proportionate to a local quote manager. There are no requests for unrelated secrets or config paths.
Persistence & Privilege
always is false and the skill does not request permanent system-wide privileges. Autonomous invocation is allowed by default but does not combine with additional privileged requests in this skill's metadata. The main risk is the ambiguous automated-delivery behavior, not a privileged install.
What to consider before installing
This skill appears to be a straightforward, local quotes manager (creates ~/quotes, saves and tags quotes). The main thing to watch for is automated delivery: the SKILL.md says the agent should 'automatically send quotes' and use a 'notification' channel but doesn’t say where or how. Before installing or enabling autonomous runs, decide how you want automated deliveries to work (local desktop notifications, email, Slack, etc.), and confirm the platform will not send quote text to external services without your approval. Consider: run it in manual mode first, restrict autonomous invocation if possible, review what the agent will do when it 'asks/infers' authors (it may perform web lookups), set proper file permissions for ~/quotes if you store sensitive personal notes, and require explicit consent for any external integrations (notification services, messaging APIs). If you need the skill to send through a particular service, prefer an implementation that declares the necessary credential variables so you can control and audit them.Like a lobster shell, security has layers — review code before you run it.
latestvk97bf6tjz00aq91p006rpbqyk980zhht
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
OSLinux · macOS · Windows