Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match behavior: the SKILL.md and included script only read local heartbeat data, compute a phase, output a report, and persist phase state. There are no unrelated credentials, binaries, or external endpoints required.
Instruction Scope
Instructions stay within the stated purpose (read heartbeat, decide phase, suggest scheduling and trigger other Apollo skills). Minor inconsistency: SKILL.md references a scripts/heartbeat-logger.sh file and a .circadian/ path in the implementation list, but the repository only includes scripts/circadian/circadian-check.sh and SKILL.md; heartbeat-logger.sh is not present. The script also expects the /tmp/heartbeat-realtime.json to contain a "time" field — if the actual heartbeat file format differs, behavior will fallback to system date or fail to parse.
Install Mechanism
Instruction-only skill with a small included Bash script; no install spec, no network downloads, and no packages are pulled. Low installation risk.
Credentials
The skill requests no environment variables or credentials. It does write persistent state to a hardcoded path: /root/.openclaw/workspace/.circadian/phase-state.json. Writing to /root is beyond the minimal footprint and assumes the agent has permission to write there; this is not a secret-exfiltration risk but is a privilege/placement assumption to verify.
Persistence & Privilege
always:false and agent-autonomy defaults are unchanged. The script creates a directory and writes its own state file in /root/.openclaw/workspace/.circadian/. That is local persistence and not an attempt to alter other skills' configs, but the hardcoded root path could conflict with host policies or require elevated privileges — confirm intended runtime user and storage location.
Assessment
This skill appears to do what it claims: read a heartbeat file, compute your circadian phase, print a report, and save state. Before installing or enabling it: 1) Confirm where it will run and whether it can write to /root/.openclaw/... — the script hardcodes that path and will create files there. If you don't want writes under /root, modify the path. 2) Ensure /tmp/heartbeat-realtime.json contains a "time" field in the expected format, otherwise the script falls back to the system date or may mis-parse hours. 3) Note SKILL.md references a heartbeat-logger script that is not included — integration may be incomplete. 4) The script has minor parsing edge-cases (hour values with leading zeros can break numeric comparisons); consider testing on your agent in a safe environment. 5) There are no network calls or secret requirements, but the skill will suggest triggering other Apollo skills (apollo-dream, apollo-neuro) — review those skills' permissions before allowing chained actions.Like a lobster shell, security has layers — review code before you run it.
latestvk972aj29hwh00zsmag44xm374184d6eb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⏰ Clawdis