RPG Quest Master — Daily Quests for Real Life
v1.0.0Generate daily and weekly RPG-style quests tailored to your goals, tracking progress and adjusting difficulty based on completion to boost productivity and s...
⭐ 0· 417·2 current·2 all-time
by@ryudi84
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (generate and track RPG-style quests) is plausible, but SKILL.md explicitly references reading the player's configured goals from config/goals.json, updating quest lists, and 'passing to the XP Engine'. The registry metadata declares no config paths, binaries, or credentials. That mismatch (explicit file paths and an external engine vs no declared storage/requirements) is incoherent: a legitimate implementation should declare where it reads/writes data or rely on agent memory and not hard-code an undeclared filesystem path.
Instruction Scope
Instructions instruct the agent to parse natural-language user reports, match them to quests, create ad-hoc XP awards, update quest lists, and run adaptive-difficulty logic. They also reference a specific file path (config/goals.json) and an undefined component ('XP Engine'). These steps imply filesystem I/O and persistent state, scheduling ('Every morning'), and possibly cross-component calls — none of which are explained or constrained. The instructions are therefore ambiguous and grant broad discretion to the agent.
Install Mechanism
No install spec and no code files — this is instruction-only, which is the lowest installer risk. Nothing will be downloaded or written by an installer step as provided.
Credentials
The skill declares no required environment variables or credentials, which is appropriate for a local quest generator. However, the SKILL.md's reference to a concrete config path (config/goals.json) and an external 'XP Engine' suggests it expects access to storage or services that are not declared. That lack of declared permissions or storage location is a proportionality/clarity issue to resolve.
Persistence & Privilege
The runtime instructions assume persistent storage (updating quest lists, tracking completion rates, scheduled daily generation) but the skill does not declare any config paths or explain where data is stored. While the skill is not marked always:true, the implied need to read/write files or long-lived state is a privilege that should be explicitly documented; as-is it's unclear what the agent will try to access or modify.
What to consider before installing
Before installing, ask the skill author to clarify these points: (1) Where are user goals and quest lists stored? If the skill expects config/goals.json, insist they declare that config path or change instructions to use the agent's memory API. (2) What is the 'XP Engine'? Is it an internal component, a separate service, or a library that will be installed? Provide concrete implementation details. (3) Does the skill ever read arbitrary files or only its own dedicated storage location? Require that it only use a single dedicated folder (and have that path declared). (4) Will any data be transmitted externally? If so, which endpoints and what authentication is used? (5) How is scheduled 'every morning' execution performed — does it require background jobs, and what permissions are needed? If the author cannot provide clear answers and explicit declarations (config paths, storage behavior, any external endpoints), treat the skill as risky: test it in a sandboxed environment and do not grant filesystem or network permissions to your agent until those details are resolved.Like a lobster shell, security has layers — review code before you run it.
gamificationvk97f6xkx269d62tmmczbtsb0qs81pby0goalsvk97f6xkx269d62tmmczbtsb0qs81pby0latestvk97f6xkx269d62tmmczbtsb0qs81pby0productivityvk97f6xkx269d62tmmczbtsb0qs81pby0questsvk97f6xkx269d62tmmczbtsb0qs81pby0rpgvk97f6xkx269d62tmmczbtsb0qs81pby0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.