wordpal

单词记忆 Skill，结合memory个性定制学习新词、复习到期词、查看学习报告。

Security Scan

WordPal's code and runtime instructions are consistent with a local, Node-based vocabulary learning skill that reads/writes a local workspace and memory summary; it does not request unrelated credentials or network installs.

Purpose & Capability

Name/description (单词记忆) match the included scripts and docs: the repo provides local Node scripts for onboarding, session context, question generation, answer submission, profiling and reporting. The single required binary is node, which is appropriate.

Instruction Scope

SKILL.md instructs the agent to run specific local scripts under the skill directory and to rely on JSON outputs. It explicitly forbids direct raw SQLite manipulation and limits LLM responsibilities. The scripts operate on local workspace and memory directories; there are no instructions to read unrelated system files, shell history, or to call external endpoints.

Install Mechanism

No install spec is provided (instruction-only from the registry perspective) and the repo contains plain Node scripts. There are no downloads or remote installers referenced in SKILL.md or README. The only install requirement (Node >= 22.5.0) is reasonable for this codebase.

Credentials

The skill requests no environment variables or external credentials. It does read and write a workspace under the user's home (default ~/.openclaw/workspace/wordpal) and reads the memory directory (~/.openclaw/workspace/memory by default) for personalization — this is expected for a learning skill but means the skill will access persisted user memory and a local SQLite DB containing profile and vocab data. If those directories contain sensitive data, consider where the workspace is located or supply an alternate --workspace-dir/--memory-dir.

Persistence & Privilege

always:false and user-invocable:true. The skill reads/writes only its own workspace (and a shared memory dir under the OpenClaw workspace). It does not modify other skills or system-wide agent settings. Autonomous invocation is allowed by default (platform normal), which increases blast radius only if combined with other red flags (none present).

Assessment

This skill appears coherent: it is a local Node-based vocabulary workflow that reads/writes a SQLite-backed workspace and a memory summary directory to personalize exercises. Before installing, confirm you are comfortable with the default workspace path (~/.openclaw/workspace/wordpal) and memory directory (used to personalize content); if not, plan to run it with an explicit --workspace-dir/--memory-dir. Review the scripts if you expect strict data isolation (they operate on local files, not remote endpoints). Ensure your Node version meets the stated requirement. If you will allow autonomous agent invocation, be aware the agent could run the skill's scripts during conversations (this is normal), so keep the workspace in a directory you control. If you want extra assurance, run the scripts locally and inspect the generated files before connecting them to your agent.

WordPal · 主控协议

技能目录约定

• 默认 ClawHub 安装路径：./skills/wordpal
• 下文命令中的 <skill-dir> 默认等于 ./skills/wordpal
• 若宿主把技能安装到别处，必须先把 <skill-dir> 替换成实际安装目录，再执行脚本

---

执行顺序（固定）

1. 先判断用户意图：
   • 若用户明确在问”有什么功能 / 能做什么 / 支持什么 / 哪些能调 / 能不能帮我调整”：直接读取 references/features.md 回答，不执行任何脚本，不进入 learn/review/report。
   • 否则路由到对应流程：

意图	触发条件	读取文件
learn	学习意图，或用户只输入 /wordpal	references/learn.md
review	复习意图	references/review.md
report	报告意图	references/report.md

2. 进入 learn / review / report 前，先执行 node <skill-dir>/scripts/session-context.js --mode <learn|review|report>：

   • 若 data.profile_exists = false：读取 references/onboarding.md，引导用户完成初始化，不继续执行流程。
   • 若 data.profile_exists = true：使用 data.profile 作为用户画像唯一真值，继续执行对应流程。

3. 对应流程执行前，先执行该流程要求的其余脚本，脚本成功后再回复用户。

---

用户画像契约

• 所有画像读写统一通过 profile.js 完成，不要在提示词里直接改文件。
• 进入流程后，以 session-context.js 返回的 data.profile 作为当前用户画像唯一真值。
• learn 中允许更新的字段：difficulty-level（I-V）、daily-target（1-100）。
• report 中允许更新的字段：report-style（MIXED | EXAM | LIFE）。

---

状态与动作

共享事件映射（learn/review 共用）

用户表现	脚本动作
答对	submit-answer.js --event correct
答错	submit-answer.js --event wrong
说不知道后记住	submit-answer.js --event remembered_after_hint
说不知道后仍不会	submit-answer.js --event wrong
跳过/会了/别再出现/斩词	submit-answer.js --event skip
新词确认进入学习	next-question.js --validate

"说不知道后记住"vs"仍不会"判断标准：

• remembered_after_hint：用户看到答案/提示后，主动复述、造句或明确表示"我知道了/记住了" 。
• wrong：用户看到答案后无回应、表示"还是记不住/没印象"、或仅被动确认。

---

脚本调用规范（必须遵守）

脚本	类型	必填参数	常用可选
profile.js	读写	get 或 set 子命令	--learning-goal --push-times --report-style --difficulty-level --daily-target --created
push-plan.js	只读	—	--workspace-dir
next-question.js	热路径复合	--mode --word --item-type	--status --difficulty-level --last-type --validate --today
submit-answer.js	热路径复合	--word --event --last-reviewed	--op-id --remaining-count
question-plan.js	只读	--mode --word --item-type	--status --difficulty-level --last-type --today
updater.js	WAL	--word --event --last-reviewed	--first-learned --status(legacy) --op-id
stage-word.js	WAL	--word	--op-id
select-review.js	只读	—	--today --diagnostics
session-context.js	只读	--mode	--today
session-summary.js	只读	--mode --op-ids	--today --top-risk
report-stats.js	只读	—	--today --days --top-risk
validate-new-words.js	只读	--words	—

所有脚本前缀：node <skill-dir>/scripts/。 成功返回 { meta, data } JSON。

日期默认由脚本按本地时区取当天；只有回放历史日期时才显式传 --today。

脚本失败统一兜底：系统暂时不可用，请稍后再试。

---

禁止项

• 不要直接操作 SQLite 词库文件或输出内部表快照。
• 不要跳过脚本直接改词条。