Notebook
v1.0.2Local-first personal knowledge base for tracking ideas, projects, tasks, habits, and any object type you define. YAML-based with no cloud lock-in.
⭐ 8· 2.9k·14 current·14 all-time
bySeth Rose@thesethrose
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (local-first personal knowledge base) match the code: store.js implements local YAML object types, index.json, and per-type object files under a workspace 'notebook' directory. No unrelated cloud APIs or unexpected capabilities are present.
Instruction Scope
SKILL.md instructs the agent to define types and manage objects via the CLI. The runtime code performs only filesystem operations to manage types and objects; the instructions do not ask the agent to read unrelated files, network endpoints, or credentials.
Install Mechanism
There is no install spec (instruction-only), which is low risk. The package.json/package-lock list js-yaml and uuid as dependencies; if a user chooses to run the CLI they may need to install those. No downloads from untrusted URLs or archive extraction are present.
Credentials
The skill declares no required env vars, but the code reads process.env.CLAWD_WORKSPACE to locate the workspace (optional fallback behavior exists). This is a minor mismatch: the env var is optional and reasonable for configuring workspace location, but it isn't documented in requires.env.
Persistence & Privilege
always is false; the skill does not request persistent system privileges or modify other skills. It writes data into a workspace-level 'notebook' directory only and does not alter global agent configuration.
Assessment
This skill is a local, filesystem-based notebook and appears coherent with its description. Before installing, note:
- It will create and write files under WORKSPACE/notebook (the code uses CLAWD_WORKSPACE if set, otherwise infers the workspace). Ensure you are comfortable with files being created there and that the agent has write permission.
- The code reads an optional CLAWD_WORKSPACE env var but the skill metadata does not list it; if you rely on a custom workspace set that env var.
- There are no network calls or credential requests in the code. Dependencies (js-yaml, uuid) are in package.json; if you plan to run the CLI, install dependencies in a controlled environment (or review package-lock) before running.
- If you want extra assurance, run the CLI in a sandboxed environment or inspect/execute the files locally rather than granting the agent broad runtime access.Like a lobster shell, security has layers — review code before you run it.
ideasvk974ax6mxf76n864131wd7mrvh7z1qpgknowledgevk974ax6mxf76n864131wd7mrvh7z1qpglatestvk974ax6mxf76n864131wd7mrvh7z1qpgprojectsvk974ax6mxf76n864131wd7mrvh7z1qpg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.