Daily Vocab
v1.0.0每天学习一个高级英语词汇，含发音、词源、例句和用法，精美闪卡呈现。Daily advanced English vocabulary card with pronunciation, etymology, examples, and quiz mode. Trigger on：每日词汇、今日单词、学个单词、每日一...
⭐ 2· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (daily vocab + push) align with the provided code and SKILL.md. The three scripts implement push-enable/disable/status and morning/evening message generation, which is coherent with the '推送管理' section. One minor note: scripts read/write per-user JSON under a local data directory and the SKILL.md asks the agent to write HTML to /mnt/user-data/outputs — these filesystem usages are reasonable for this skill but are not declared in requires.configPaths; expect local file I/O.
Instruction Scope
SKILL.md gives focused, concrete instructions: pick a themed advanced word, verify with web_search, build an HTML flashcard, save to /mnt/user-data/outputs/daily-vocab.html, and optionally use the push CLI. No steps ask the agent to read unrelated system files or to collect secrets. The use of web_search (an agent tool) is expected for verification and examples.
Install Mechanism
No install spec (instruction-only) and included JavaScript files are small and readable. No downloads, remote installers, or obfuscated code were found in the provided files.
Credentials
The skill requests no environment variables or external credentials. It does read and write local user records under ../data/users and writes the output HTML to /mnt/user-data/outputs; this local filesystem access is proportionate to push management and saving cards but the config paths were not declared in metadata—review where your platform stores skill data before enabling push.
Persistence & Privilege
always:false and normal autonomous invocation. The push-toggle script prints scheduler directives (__OPENCLAW_CRON_ADD__/__OPENCLAW_CRON_RM__) to register cron jobs (session:'isolated') which is expected for a push feature. The skill does not modify other skills or request elevated system privileges.
Assessment
This skill appears to do what it says: generate a vocabulary HTML flashcard and optionally enable scheduled morning/evening pushes. It asks for no credentials and installs nothing. Before installing/using: 1) note it will write files under the skill's data directory (../data/users) and output HTML to /mnt/user-data/outputs — confirm you are comfortable with that storage location; 2) enabling push will register scheduled jobs (the skill emits scheduler directives) that cause the platform to run the included node scripts and send messages to the configured channel — only enable push if you trust the skill owner and understand which channel (telegram/feishu/slack/discord) will be used; 3) the visual design mentions external fonts/resources (e.g., Google Fonts) which you or the agent might fetch when rendering the HTML — if you want to avoid external network requests, instruct the agent to inline fonts/resources or use system fonts; 4) the package has no homepage and an unknown source owner — that reduces external accountability. If any of these are concerns, review the generated HTML and the small scripts before enabling push.Like a lobster shell, security has layers — review code before you run it.
latestvk977vb7wskq79x32fwnaha072d842ddm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.