Back to skill
Skillv1.0.7
ClawScan security
Book Of The Day · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 6, 2026, 4:03 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions are consistent with a simple 'daily book' oracle that fetches data from a single external API and does not request unrelated credentials or elevated privileges.
- Guidance
- This skill appears coherent and low-risk, but consider these practical points before installing: - Default external endpoint: by default the skill will fetch books from https://book-of-the-day.vercel.app (or whatever BOOK_OF_THE_DAY_API_URL you configure). If you rely on the default, your queries (date and request metadata) go to that external service — only use it if you trust that endpoint. If you provide a private API URL, verify it before storing it in your agent config. - One-command installers and cron: INSTALL.md suggests running clawhub and openclaw cron commands which will write skill configuration and can schedule automated pushes to channels (Telegram/Slack). Review the CLI command and target channels before executing; ensure your channel credentials and settings are configured and trusted. - No secrets required: the skill does not request API keys or other credentials by default. Optional audio/language env vars are fine to configure but are not required. - Privacy: the skill's requests are limited to fetching book metadata (title, author, topics, etc.). If you plan to include user-specific data in requests, review what the API stores/returns. If you want stronger assurance, ask the publisher for the API implementation or host the API yourself and set BOOK_OF_THE_DAY_API_URL to your trusted endpoint.
Review Dimensions
- Purpose & Capability
- okName/description align with the declared behavior: fetch a daily book from an API, produce a short poetic reading, and optionally show cover/audio. No unrelated binaries, credentials, or config paths are required.
- Instruction Scope
- okSKILL.md only instructs the agent to GET from the configured BOOK_OF_THE_DAY_API_URL (default: a Vercel endpoint), format a short reading, and honor a closing CTA rule. It does not read arbitrary files or request unrelated environment variables. It does reference writing/setting a skill config in ~/.openclaw/openclaw.json in INSTALL.md for optional configuration—this is consistent with configuring the skill.
- Install Mechanism
- okThis is an instruction-only skill (no install spec). INSTALL.md suggests using platform CLI commands (clawhub / openclaw cron) to install and schedule pushes; these are expected and do not pull arbitrary archives or unknown URLs.
- Credentials
- okNo required environment variables or credentials. A few optional env vars for audio/language are declared in operator notes; these are proportional and optional.
- Persistence & Privilege
- okalways:false (default). The skill may be scheduled via openclaw cron only if the user runs those commands; it does not request persistent/global privileges or modify other skills' configurations.