Period Care Assistant

Track menstrual cycle history, answer current cycle status questions, record new period start dates from natural-language messages such as "月经来了", predict th...

Security Scan

The skill is internally consistent with its stated purpose: it runs a local Node helper, stores data encrypted with a single required key, and exposes configurable reminder delivery — but be careful when you configure external webhooks or cron payloads since those can leak sensitive information if misused.

Purpose & Capability

The name/description match the actual behavior: a Node script that records period start dates, predicts next starts, and generates reminder plans. The only required runtime pieces are node/nodejs and a single PERIOD_TRACKER_KEY. No unrelated cloud credentials, system services, or surprising binaries are requested.

Instruction Scope

Runtime instructions are explicit: call the included scripts for record/status/configure/reminder-plan and keep all data in the encrypted local store. The instructions also show creating cron jobs whose payloads contain human-readable reminder text (including predicted start dates). That is coherent for reminder delivery, but those cron payloads or configured webhooks could expose sensitive health data if the cron store, logs, or webhook endpoints are not trusted.

Install Mechanism

No external installers or downloads; this is instruction-only with bundled Node scripts. Nothing is fetched from remote URLs or written from an external archive during install.

Credentials

Only a single secret is required (PERIOD_TRACKER_KEY) and an optional store path (PERIOD_TRACKER_STORE) is documented. The key is used to derive an AES-256-GCM data key for local encryption — this is proportionate to the stated goal of encrypted local storage.

Persistence & Privilege

always:false and normal autonomous invocation. The skill writes to its own encrypted state file (default in the skill's .state directory or an explicit PERIOD_TRACKER_STORE), and does not request system-wide privileges or modify other skills. Note: the flow recommends creating cron jobs/agent-turn payloads which, depending on your cron/cron-store visibility and delivery configuration, may leak reminders if not handled carefully.

Assessment

This skill appears to do what it says: a local, encrypted period tracker implemented as a Node script that needs one secret (PERIOD_TRACKER_KEY). Before installing: (1) keep PERIOD_TRACKER_KEY private and consider providing a per-skill key rather than a broader account secret; (2) set PERIOD_TRACKER_STORE to a secure path you control if you are concerned about where the encrypted file will live; (3) be cautious when configuring delivery-mode=webhook or creating cron jobs — verify that the webhook endpoint is trusted, uses HTTPS, and that cron job payloads and logs are not visible to third parties, since reminder text includes predicted start dates which are sensitive health data; (4) run the included tests locally to validate behavior. If you plan to connect external bridges (DingTalk/webhook), review their privacy/security before enabling automatic delivery.

Overview

Use the helper script at {baseDir}/scripts/period_tracker.mjs for all reads and writes so period history, forecasts, and reminder plans stay deterministic. Keep all cycle data local, encrypted, and scoped by a stable per-user key such as dingtalk:<staffId> or telegram:<userId>.

Handle User Identity

Build a stable userKey before touching storage.

• Prefer the channel's immutable sender identifier.
• Prefix it with the transport, for example telegram:123456, slack:U123, or dingtalk:manager123.
• Do not use display names as the primary key unless there is no stable id.
• If the user is in a shared chat, keep records per person and confirm who the record belongs to before writing.

Record A New Period Start

When the user says anything equivalent to "月经来了", "今天来例假了", "帮我记一下今天来姨妈", or "记一下 2026-03-18 来月经":

1. Infer the start date from the message. If no date is given, use the user's local date and say which date was recorded.
2. Run:

node "{baseDir}/scripts/period_tracker.mjs" record --user "<userKey>" --date "<YYYY-MM-DD>" --json

3. Read the returned JSON and reply with:
   • the recorded start date,
   • the predicted next start date,
   • the reminder date,
   • a short caring sentence.
4. If the user also gives reminder preference, timezone, route, or period length, include:

node "{baseDir}/scripts/period_tracker.mjs" record --user "<userKey>" --date "<YYYY-MM-DD>" --reminder-days 4 --timezone "Asia/Shanghai" --delivery-mode webhook --delivery-webhook "https://example.invalid/reminder" --json

Answer Status Queries

When the user asks "我现在是什么周期", "帮我查一下月经周期", "下次大概什么时候来", or similar:

node "{baseDir}/scripts/period_tracker.mjs" status --user "<userKey>" --json

Explain the result in natural language:

• current phase,
• days since last recorded start,
• predicted next start date,
• reminder status,
• confidence level and uncertainty when history is sparse or irregular.

Do not state medical certainty. Say the estimate is data-based, not a diagnosis.

Configure Reminder Delivery

The helper script stores reminder preferences and generates a one-shot cron plan.

Use:

node "{baseDir}/scripts/period_tracker.mjs" configure --user "<userKey>" --timezone "Asia/Shanghai" --reminder-days 4 --delivery-mode announce --delivery-channel "telegram" --delivery-to "user:123456" --json

Supported delivery modes in the helper:

• announce: for native OpenClaw chat delivery routes.
• webhook: for an external bridge or webhook endpoint.
• none: keep the prediction but do not arm a delivery route yet.

If reminder delivery is configured, fetch the plan:

node "{baseDir}/scripts/period_tracker.mjs" reminder-plan --user "<userKey>" --json

Then create or refresh a one-shot cron job. Prefer a deterministic job name from the JSON output. Use schedule.kind = "at" and the generated ISO timestamp. For isolated delivery jobs, use the generated prompt text as the agentTurn.message. See {baseDir}/references/deployment.md for a complete cron JSON example.

Natural-Language Interaction Style

Keep the interaction short, warm, and explicit.

• Accept colloquial Chinese such as "姨妈来了", "例假来了", "下次大概啥时候".
• After recording, confirm the exact date that was saved.
• If fewer than two historical records exist, explain that the next prediction is a provisional baseline.
• If the forecast confidence is low or the estimated error exceeds two days, say that clearly instead of overstating accuracy.
• If the user says the cycle is highly irregular, severe pain is present, or bleeding is unusual, suggest professional medical advice.

Privacy And Safety Rules

• Never print or quote the encryption key.
• Keep raw history in the encrypted store only.
• Avoid putting full menstrual history into logs, commit messages, or public summaries.
• Share only the minimum needed in chat responses unless the user explicitly asks for the detailed history.
• If this skill is published to ClawHub, remember ClawHub is public. Publish code and instructions only, never real user data or secrets.

Read More Only When Needed

• Read {baseDir}/references/deployment.md when you need OpenClaw cron, ClawHub publish, or DingTalk transport notes.
• Read {baseDir}/references/model-and-privacy.md when you need the forecasting method, storage layout, or accuracy caveats.