ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Notes (Local, Apple, Notion, Obsidian & more)

v1.1.3

Let your agent write notes anywhere: local markdown, Apple Notes, Bear, Obsidian, Notion, Evernote, configurable per note type.

⭐ 3· 3.2k·30 current·32 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (notes across local, Apple, Bear, Obsidian, Notion, Evernote) matches the declared optional CLIs, config paths, and platform-specific instructions. No unrelated credentials, binaries, or system-wide changes are requested.
ℹ
Instruction Scope
SKILL.md confines activity to ~/notes/ and to optional platform config paths (~/.config/notion, ~/.config/grizzly, Obsidian vaults). It states it will ask for user consent before checking CLIs or reading credential files. That is coherent, but the behavior depends on the agent honoring that interactive consent; the instructions include examples that read credential files (e.g., cat ~/.config/notion/api_key) which are appropriate only after explicit user configuration/consent.
✓
Install Mechanism
Instruction-only skill with no install spec and no downloads. Optional third-party CLIs are user-installed per platform docs; this is low-risk and proportional to the stated integrations.
✓
Credentials
No required environment variables or credentials are declared. Optional credentials and config paths (Notion API key, Bear token, etc.) are reasonable and documented for the corresponding integrations. The skill explicitly treats them as opt-in and local (files under ~/.config or vault paths).
✓
Persistence & Privilege
Skill is not always-enabled and uses normal autonomous invocation. It creates and manages files under ~/notes/ (documented) and does not request system-wide persistence or to modify other skills. No elevated privileges are requested.
Assessment
This skill appears coherent with its purpose, but it performs filesystem and (optionally) network actions when you enable external integrations. Before using it: (1) Confirm the agent asks you before checking for CLIs or reading ~/.config/* credential files — don’t allow access unless you expect it. (2) Store API keys/tokens in the documented local paths and audit them yourself. (3) Review ~/notes/config.md after the initial setup to verify routing choices. (4) Be aware action items are aggressively extracted and synced to ~/notes/actions.md and that external platforms (Notion, Evernote) will send data off your machine if you enable them. If you want tighter control, keep everything routed to local files only.

Like a lobster shell, security has layers — review code before you run it.

latestvk971w01sqh8tx9kmj6rbt85va981vb37

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📝 Clawdis
OSLinux · macOS · Windows

Comments