Bucket List

Use this skill when the user wants to record, view, update, complete, cancel, or review a personal bucket list / wish list. Supports Chinese commands such as...

Security Scan

The skill is internally consistent with a local-only bucket-list tool: it runs a local HTTP GUI and a CLI and stores data in a workspace JSON file; no external network calls or secret requests are present.

Purpose & Capability

Name/description match the implementation: CLI, local HTTP GUI, and JSON data storage. The skill legitimately needs filesystem access to a workspace data file and provides a CLI/server to manage that data.

Instruction Scope

SKILL.md instructs running node server.js and the CLI, which is consistent with the code. Implementation detail divergence: the docs state "server only accepts same-origin browser writes by default", but the server's isSameOrigin() returns true when the Origin header is absent — meaning non-browser local POSTs (curl, local services without Origin) will be accepted. The skill also reads/writes a workspace-level data file (documented), which is expected for this purpose.

Install Mechanism

No install spec; this is an instruction-only skill with bundled scripts — nothing is downloaded from external URLs and no packages are installed during skill install.

Credentials

No credentials requested (good). The code does read optional env vars (BUCKET_LIST_DATA_FILE and BUCKET_LIST_PORT) but the SKILL.md does not declare these environment variables in the requirements section — they are reasonable optional overrides but users should be aware they exist.

Persistence & Privilege

always is false; the skill does not modify other skills or global agent settings. It writes data to a workspace data path (creates backups) which is appropriate for a local data management tool.

Assessment

This skill appears to be a harmless local bucket-list manager. Before installing: 1) note it will create/read/write <workspace>/data/bucket-list.json (or the file you set via BUCKET_LIST_DATA_FILE) — don't store secrets there. 2) The server binds to 127.0.0.1, but the implementation accepts POSTs that lack an Origin header (so local tools like curl or other local services can POST); if you need stricter protections, run it behind a firewall or avoid starting the server. 3) You can change the port with BUCKET_LIST_PORT and the data file with BUCKET_LIST_DATA_FILE. 4) Review the bundled files if you have sensitive data concerns; no external network endpoints or credential requests are present.

愿望清单 (Bucket List)

记录主人与龙虾一起完成的人生愿望清单。它不是待办软件，也不是人生导师；它是一个本地优先的愿望记录和成就回顾工具。

When To Use

Use this skill when the user asks to:

• add a wish, bucket-list item, life goal, or "愿望"
• view pending, completed, or cancelled wishes
• mark a wish completed or cancelled
• review completed wishes or shared achievements
• open or maintain the bucket-list GUI
• import, export, or repair bucket-list data

Quick Start

Start the GUI:

cd skills/bucket-list
node server.js
# open http://localhost:9999/

Use the CLI:

./bucket-list.sh add "去南极看企鹅" "旅行"
./bucket-list.sh view
./bucket-list.sh complete "南极" "看到了企鹅"
./bucket-list.sh cancel "学吉他" "改学钢琴"
./bucket-list.sh achievements

Natural-language entry:

./bucket-list.sh intent "添加愿望：去南极看企鹅"
./bucket-list.sh intent "查看愿望清单"
./bucket-list.sh intent "完成了 发布技能"
./bucket-list.sh intent "我们完成了什么"

Data

The runtime data file is stored outside the skill folder:

<workspace>/data/bucket-list.json

The published data/bucket-list.json inside this skill is only an empty template. Do not publish personal wishes in the package.

Canonical wish fields:

• id
• content
• category
• status: pending, completed, or cancelled
• createdAt
• endedAt
• endedBy
• completionNote
• cancelReason
• timeline

Safety

• The server binds to 127.0.0.1 only.
• The server only accepts same-origin browser writes by default.
• Writes are validated, size-limited, and saved atomically with a backup.
• The CLI uses Node JSON parsing/writing instead of shell text edits.

Boundaries

• Do not treat ordinary tasks as wishes unless the user frames them as a wish, life goal, or bucket-list item.
• Ask before recording sensitive or emotionally loaded content if the user's intent is unclear.
• Strong negative emotion should receive care first; record or update wishes only after the user confirms.