Medication Manager
v1.0.1Family medication management skill using file-based storage (no database required). Supports medication entry via photo/image (prescription, medicine box), t...
⭐ 0· 24·0 current·0 all-time
by佐岸流年L@liucunguang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description, included files, and runtime instructions are coherent: file-based markdown storage, member profiles, batch tracking, expiry alerts (scripts/check_expiry.py), and reminder configuration via cron/webhooks all match the stated purpose. The included Python expiry script directly supports the advertised expiry-alert feature.
Instruction Scope
Runtime instructions confine actions to creating/reading/writing files under data/, parsing markdown, using a vision model to extract info from user-supplied photos, and configuring reminders (OpenClaw cron or user-provided webhooks). There are no instructions to read unrelated system files or request unrelated credentials. Caveats: (1) the skill asks agents to detect the current conversation channel (reasonable for reminders) which gives the agent some contextual access; (2) using vision models or sending test notifications implies image data or test messages could be sent externally depending on how the agent/platform implements vision and webhook delivery; and (3) the SKILL.md triggered a prompt-injection regex for unicode-control-chars — this could hide or obfuscate text and should be inspected.
Install Mechanism
No install spec is provided (instruction-only), so nothing is downloaded or installed. A single benign Python script is included; running it is optional and limited to scanning markdown files. This is low installation risk.
Credentials
The skill declares no required environment variables, no primary credential, and no config-path access. The only external secrets it might use are user-supplied webhook URLs or platform-specific targets (provided by the user). That is proportionate to reminder functionality.
Persistence & Privilege
always is false, the skill is user-invocable, and it does not request or modify other skills or system-wide agent settings. It stores data locally under data/, which matches the stated file-based design and does not imply elevated privileges.
Scan Findings in Context
[unicode-control-chars] unexpected: The static scan detected unicode control characters in SKILL.md. This is not required for a medication manager and can be used to hide or obfuscate content (prompt injection). The visible files appear normal, but you should inspect the raw SKILL.md for hidden control characters before trusting the skill.
Assessment
This skill is internally consistent with its description and does not request credentials, but take these precautions before installing: 1) Inspect SKILL.md/README raw text for invisible unicode control characters (the scanner flagged these). 2) Only provide webhook URLs or notification targets you control and trust; don't paste tokens/webhook URLs from unknown services. 3) If you run the included script, do so in a controlled environment (it only reads markdown files but run with the intended data directory). 4) Be aware that image/photo extraction may send image data to whatever vision provider your agent/platform uses — confirm where images are sent and privacy implications. 5) For medical guidance, treat the included references as convenience material and consult a clinician for serious or uncertain cases. If any of these points are unacceptable or the SKILL.md contains hidden content, do not install.Like a lobster shell, security has layers — review code before you run it.
familyvk97cqgeh850q088pjnzfvwwe8984sqashealthvk97cqgeh850q088pjnzfvwwe8984sqaslatestvk97cqgeh850q088pjnzfvwwe8984sqasmedicationvk97cqgeh850q088pjnzfvwwe8984sqas
License
MIT-0
Free to use, modify, and redistribute. No attribution required.