macos-suite-readonly

macOS 只读查询：Mail 未读、Calendar 日程、Notes 搜索、Stocks 行情（输出 JSON）。

Security Scan

The skill's files, requirements, and runtime instructions match its stated purpose: it uses osascript to read Mail/Calendar/Notes locally and fetches stock quotes from a single allowlisted host; there are no unexplained credentials, installs, or external endpoints.

Purpose & Capability

Name/description promise read-only macOS queries (Mail unread, Calendar, Notes, Stocks). Declared OS=d arwin and required binaries (python3, osascript) are exactly what the code uses. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md only instructs running the included Python script with command-style args. The script uses osascript to read Mail, Calendar, and Notes (consistent with description) and performs HTTP GETs only for stock data. It does not read arbitrary filesystem paths or environment variables beyond expected runtime needs. Note: accessing Mail/Notes/Calendar will trigger macOS automation/privacy prompts.

Install Mechanism

No install spec; this is instruction-only with the Python script bundled. Nothing is downloaded or extracted from external URLs during install, so installation risk is low.

Credentials

No environment variables or credentials are required. The script accesses local user data via AppleScript (which is proportional to the skill's purpose). It makes outbound requests only to an allowlisted domain (qt.gtimg.cn) for stock quotes.

Persistence & Privilege

always is false and the skill does not request persistent system changes or modify other skills. disable-model-invocation is default (agent may call the skill autonomously), which is normal; this combined with local data access is a privacy consideration but not an incoherence.

Assessment

This skill appears to do what it says. Before installing: (1) be aware it will access your Mail, Calendar, and Notes via AppleScript and macOS will likely prompt you to allow automation/access — only grant that if you trust the skill. (2) Stock data is fetched from qt.gtimg.cn; if you need a different provider, review/modify the script. (3) The full Python script is bundled (scripts/main.py) — review it yourself if you have concerns. (4) Because the agent can call the skill autonomously, consider whether you want an agent to be able to read your local Mail/Notes/Calendar without additional controls.

面向 ClawHub 的“只读”macOS 查询技能：读取邮件未读、日程、备忘录搜索、股票行情。所有命令输出单个 JSON，适合 agent 解析。

⚠️ 权限

• 首次调用可能弹出系统权限提示（自动化/隐私）。
• 若系统拒绝自动化权限，命令会返回 ok=false 或 warning。

使用方式

python3 {baseDir}/scripts/main.py <command> key=value key=value ...

Commands

Mail

python3 {baseDir}/scripts/main.py mail.unread_count
python3 {baseDir}/scripts/main.py mail.unread_list limit=20

Calendar

python3 {baseDir}/scripts/main.py calendar.today limit=50
python3 {baseDir}/scripts/main.py calendar.list start="2026-03-03 00:00:00" end="2026-03-03 23:59:59" limit=50

Notes

python3 {baseDir}/scripts/main.py notes.folders
python3 {baseDir}/scripts/main.py notes.search query="购物" limit=10 folder="Notes"

Stocks

python3 {baseDir}/scripts/main.py stocks.quote symbol=AAPL
python3 {baseDir}/scripts/main.py stocks.quote symbol=600519
python3 {baseDir}/scripts/main.py stocks.batch symbols="AAPL,600519,00700"