bark-push

专业的 Bark 推送技能。支持通过 LobeHub 市场规范定义的通知格式发送消息。

Security Scan

The skill mostly does what it says (sends a Bark push via api.day.app) but includes unexpected filesystem access (reads ../../USER.md for a BARK_KEY) and a minor metadata mismatch about environment variables, which is scope creep and could expose secrets.

Purpose & Capability

The code's primary behavior (HTTP GET to api.day.app using a Bark key) matches the 'bark-push' purpose. However, the implementation looks for a BARK_KEY in an arbitrary ancestor file (../../USER.md), which is not obviously required for a push helper and is not documented as a required config path in the registry metadata.

Instruction Scope

SKILL.md suggests running node push.js and that the key can come from the BARK_KEY env var, which is reasonable. The included push.js also tries to read ../../USER.md to extract a key if the env var is not set — this is scope creep (it reads files outside the skill folder) and could read sensitive information unexpectedly.

Install Mechanism

There is no install spec; this is an instruction-only skill with a small JavaScript file and a documented binary dependency on node. No remote downloads or extraction are performed.

Credentials

The skill uses a BARK_KEY environment variable but the registry metadata lists 'Required env vars: none'. The code will exit if no key is found. Requiring a single service key is proportionate, but searching for the key in ../../USER.md increases risk of accidental exposure of secrets.

Persistence & Privilege

The skill does not request permanent presence, does not modify other skills, and does not write persistent configuration. It only performs an HTTPS GET and local file reads.

What to consider before installing

This skill appears to do what it claims (send Bark notifications via api.day.app) but it will try to read a BARK_KEY from an ancestor file at ../../USER.md if the BARK_KEY env var is not set. That file-read is the main red flag: it may expose secrets outside the skill directory. Before installing or running: (1) prefer setting BARK_KEY in the environment and do not rely on the USER.md fallback; (2) inspect ../../USER.md in your workspace to ensure it contains nothing sensitive or rename/remove keys there; (3) if you control the skill, remove or restrict the USER.md lookup (or limit path scope) so it only reads explicit, documented config files; (4) run the script in a sandbox or limited environment if you are unsure. If the AUTHOR can explain why the ancestor USER.md lookup is necessary (for example, a known monorepo layout), that would reduce concern.

Bark Push 技能 (标准版) 🦞

简介

这是 openclaw-skills-bark-push 的本地重构版。它完全兼容 LobeHub 技能市场的调用规范。

参数说明

• message (string, 必填): 推送的消息内容。
• title (string, 可选): 消息标题。
• key (string, 可选): 您的 Bark Key（如果留空，将读取 BARK_KEY 环境变量）。

调用示例

node push.js "Hello from OpenClaw" --title "龙虾推送"