Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, tools.json, and the included CLI code consistently implement a push-to-Today (负一屏) feature; requiring Node is expected for a Node CLI. The parameters and network call in the code align with the stated purpose.
Instruction Scope
SKILL.md and tools.json instruct the agent to execute node scripts/cli.js with session-derived msgId and content. SKILL.md also mandates that scheduled tasks be pushed immediately without user confirmation — this is within the skill's purpose (automation) but is a behavioral/privacy consideration (no opt-out or confirmation).
Install Mechanism
No install spec or external downloads are present; the skill is instruction-only plus a bundled CLI script. No archive downloads or third-party installers are used.
Credentials
The CLI and SKILL.md require AS_TODAY_AUTH_CODE (and optionally AS_TODAY_API_URL). However, the registry-level metadata at the top of the submission lists no required env vars/primary credential — a packaging inconsistency that can cause silent misconfiguration. README references a DEBUG env var used by the code but DEBUG is not declared in SKILL.md metadata. The default API endpoint in the code is https://api.example.com/push2today (a placeholder) — you should verify the real endpoint before using the token.
Persistence & Privilege
Skill is not always:true, does not request system-wide config paths, and does not modify other skills. It can be invoked autonomously (default), which is normal for skills; combined with the forced auto-push rule, this increases the risk of automatic pushes but is not a privilege escalation by itself.
What to consider before installing
Before installing: 1) Confirm the AS_TODAY_API_URL points to a trusted service — the bundled default is api.example.com (placeholder). 2) Only provide an auth token (AS_TODAY_AUTH_CODE) with minimal privileges and avoid reusing high-privilege secrets. 3) Be aware scheduled tasks are configured to push immediately without asking the user; if that's undesired, do not enable automatic scheduling or modify the skill. 4) Registry metadata omits the declared required env var (AS_TODAY_AUTH_CODE) — verify your OpenClaw config sets this env so the skill won't fail or attempt to use an incorrect endpoint. 5) The CLI uses global fetch (Node >=18 or a polyfill required); ensure your runtime is compatible. 6) If you do not trust the upstream endpoint or the author (homepage and repo look like placeholders), review/modify the scripts/cli.js code to point to a known endpoint or avoid installing.scripts/cli.js:23
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97a54z42fhwyfbz4em197a74583xx16
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsnode