ClawHub

limitless-lifelogs

v1.0.0

Search, summarize, and extract insights from your Limitless AI pendant life logs. Supports keyword and semantic search, date range queries, memory recall, an...

⭐ 2· 286·1 current·1 all-time
byJeremy Toce@jeremytoce
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
Name/description (searching and summarizing pendant lifelogs) aligns with required items: curl/jq and LIMITLESS_API_KEY are reasonable. Minor incoherence: the SKILL.md expects an agents roster at ~/.openclaw/workspace/skills/limitless/agents.json, but the install script installs files under ~/.openclaw/workspace/skills/limitless_lifelogs — that path mismatch could cause failures or unexpected file reads.
!
Instruction Scope
Instructions require reading a local agents.json to derive agent names (expected) and include a dispatch flow that will POST transcript excerpts and task summaries to webhook URLs from agents.json. Sending verbatim transcript quotes and metadata to arbitrary external endpoints is sensitive and should be explicitly highlighted to the user; the skill will exfiltrate user data to those endpoints if the user confirms dispatch. The SKILL.md otherwise keeps API calls to the stated Limitless API and marks operations read-only, which is appropriate.
✓
Install Mechanism
No remote install downloads; install.sh is a local script that copies files into the OpenClaw workspace and preserves an existing agents.json. The installer doesn't fetch external code or write to unexpected system locations.
✓
Credentials
Only requests LIMITLESS_API_KEY as a required credential (primaryEnv). An optional LIMITLESS_TIMEZONE is referenced in SKILL.md (not listed as required), which is reasonable. No unrelated credentials are requested.
✓
Persistence & Privilege
Skill does not request always:true, and the installer only writes its own SKILL.md and agents.json (unless agents.json already exists). It does not attempt to modify other skills or system-wide settings.
What to consider before installing
This skill largely does what it claims, but be cautious before using the dispatch feature. Before installing or invoking: - Edit agents.json yourself and verify every dispatch.url is a webhook you control or trust; dispatch will send transcript quotes, task summaries, log IDs and timestamps to those URLs. - Fix the path mismatch: SKILL.md references ~/.openclaw/workspace/skills/limitless/agents.json while the installer places files under ~/.openclaw/workspace/skills/limitless_lifelogs. Either update SKILL.md or move/rename agents.json so the skill reads the roster you expect. - Use a limited-scope API key for LIMITLESS_API_KEY if the service supports it, and do not expose production or billing keys to third parties. - Test with non-sensitive sample logs before permitting any automatic dispatch, and consider removing or replacing webhook entries with safe endpoints until verified. If you want, I can suggest exact edits to SKILL.md or agents.json to remove ambiguity and limit data sent on dispatch.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cvszsrn90f3xzerrysmahwd81w1xv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎙️ Clawdis
Binscurl, jq
EnvLIMITLESS_API_KEY
Primary envLIMITLESS_API_KEY

Comments