Morning Briefing Litiao
v1.0.0Automation skill for Morning Briefing Litiao.
⭐ 0· 98·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The script's behavior (query Apple Reminders via remindctl and query Notion) matches the described purpose. However the skill metadata declares no required binaries or credentials while the script clearly depends on external tools (remindctl, curl, jq) and a Notion API key stored in ~/.config/notion/api_key. The absence of those declared requirements is inconsistent.
Instruction Scope
The runtime script instructs the agent (or runner) to: run remindctl, call curl to api.notion.com, and read a local file (~/.config/notion/api_key) for a bearer token. SKILL.md does not mention reading local config files or the API key path. Reading a local hidden file that likely contains credentials is out-of-band relative to the declared instructions and should have been documented.
Install Mechanism
There is no install spec (instruction-only), which minimizes install-time risk. However the script expects external binaries (remindctl, curl, jq) to be present; these are not declared in the registry metadata as required. That omission is a packaging/documentation issue but increases runtime surprises.
Credentials
No required env vars are declared, yet the script reads NOTION_TASKS_DB (optional) and — importantly — loads NOTION_KEY from ~/.config/notion/api_key. Accessing a local credential file without declaring it or asking for an API key via a declared primaryEnv is disproportionate and a privacy/credential-exposure concern.
Persistence & Privilege
The skill does not request persistent or always-on presence (always: false) and does not modify other skills or global agent config. Autonomous invocation is allowed (platform default) but does not combine with other privilege escalation indicators here.
What to consider before installing
This skill's goal (morning briefing from Reminders + Notion) is plausible, but the shipped script reads a Notion API key from ~/.config/notion/api_key and calls remindctl, curl, and jq even though none of these are declared in the skill metadata. Before installing: (1) verify the skill source/trustworthiness; (2) inspect the script yourself (it is included) and confirm you are comfortable with it reading ~/.config/notion/api_key — move or protect that file if needed; (3) ensure required binaries (remindctl, curl, jq) are present and sandbox the skill if possible; (4) prefer a version that uses an explicitly-declared environment variable for the Notion token (or add that config path/env to the skill manifest) so the behavior is documented; (5) if you do not want a skill to read local secrets, do not install or run it until it’s modified to accept credentials safely. If you want, I can suggest specific manifest changes or a safer script variant that reads the token from an env var instead of a local file.Like a lobster shell, security has layers — review code before you run it.
latestvk9729vve1akpkeb0vzedb6jexh8330c3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.