Webtop Galim

Check, monitor, and summarize student homework/tasks from Webtop (SmartSchool), Galim Pro, and Ofek. Use when the user asks to inspect homework, pending task...

Security Scan

The skill's files implement the described Webtop/Galim/Ofek scraping and calendar sync, but the registry metadata omits the many sensitive environment files and dependencies the code actually requires and the bundle references external files/paths not included — this mismatch merits caution.

Purpose & Capability

The scripts legitimately need student portal credentials and (for calendar sync) a Google service-account JSON to do what the description says. However the registry metadata claims 'Required env vars: none' and 'Required binaries: none' which is incorrect. The skill also calls an external webtop fetcher at /root/.openclaw/skills/pywebtop-skill/webtop_homework_fetcher.py (not included) — referencing another skill/repo outside the bundle. That discrepancy between declared requirements and actual needs is concerning.

Instruction Scope

SKILL.md and the wrapper instruct the agent to load environment files under /root/.openclaw/workspace/.env/*, run Playwright-based scrapers against Ministry of Education SSO portals, and optionally sync events to Google Calendar. The runtime instructions and scripts read student usernames/passwords, build OFEK_KIDS_JSON, and call Google Calendar APIs. They also rely on an external script path for Webtop. The instructions therefore access sensitive credentials and system paths not declared in the registry and reference files outside the package.

Install Mechanism

There is no declared install spec in registry (instruction-only), but the repo includes an install.sh that only creates an env template. The code relies on third-party Python packages (Playwright, google-auth, google.oauth2, etc.) and a Playwright-capable runtime, none of which are declared in registry install metadata. Also the Webtop fetcher is an external script path not bundled here — dependency on another local skill/repo increases risk/fragility.

Credentials

The code expects many sensitive environment values and files: student usernames/passwords for multiple children (GALIM_* and OFEK_*), OFEK_KIDS_JSON, GOOGLE_SA_FILE (service-account JSON), OFEK_GALIM_CALENDAR_ID, OFEK_GALIM_WHATSAPP_GROUP. The registry listed none. Requesting Ministry-of-Education student IDs & passwords and a Google service-account file is proportionate to the stated calendar-sync and scraping purpose, but the omission from metadata and the large number of secrets required (including a full Google SA JSON file) is a significant practical and security concern that should be explicit to users.

Persistence & Privilege

The skill is not always:true and does not request forced persistent installation. It does expect to read local env files and (for calendar sync) a local service-account JSON under ~/.openclaw/workspace/.secrets — these are local credentials with broad privileges if misconfigured. Autonomous invocation is allowed by default (platform default); combine that with the broad local credential usage and you should be cautious about enabling autonomous runs.

What to consider before installing

This package contains working scrapers and a calendar-sync that match the description, but the registry metadata incorrectly says no environment or binaries are required. Practical points before installing or enabling: 1) The scripts require student portal usernames/passwords (GALIM_* and OFEK_*) and a Google service-account JSON (GOOGLE_SA_FILE) to sync calendars — treat these as highly sensitive and do not reuse high-privilege accounts. 2) The repo needs Python dependencies (Playwright and Google auth libraries) and a Playwright-capable environment; these are not declared in the registry. 3) The webtop fetch step references an external script path (/root/.openclaw/skills/pywebtop-skill/webtop_homework_fetcher.py) that is not bundled here — inspect that file before use. 4) The install.sh only creates an env template; there is no safe automated install from a trusted release host. 5) If you proceed: run the scripts in an isolated environment, create a dedicated, least-privilege Google service account scoped only to the calendar you intend, store child credentials securely (not in version control), prefer dry-run sync (--dry-run), and inspect all referenced external files. Because the package hides its true required credentials/deps in SKILL.md and code (not registry metadata) treat this as suspicious until you verify provenance and dependency/credential setup.

Webtop / Galim / Ofek

Use this skill to work with Webtop / SmartSchool, Galim Pro, and Ofek student task portals.

Status

Both portals are working ✅

• Ofek (students.myofek.cet.ac.il) — working via Ministry of Education SSO
• Galim Pro (lms.galim.org.il) — working via Ministry of Education SSO

Quick start

# Webtop only
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/webtop_fetch_summary.py

# Galim only
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/galim_fetch_tasks.py

# Ofek only
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/fetch_tasks.py

# Unified report (Webtop + Galim + Ofek)
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/unified_report.py

# Expanded report for WhatsApp / review
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/expanded_report.py --days 30 --limit 5

# Sync Galim due dates to calendar
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/sync_galim_calendar.py --days 30

# JSON output
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/fetch_tasks.py --json
python3 /root/.openclaw/workspace/skills/webtop-galim/scripts/galim_fetch_tasks.py --json

Credentials

Stored in /root/.openclaw/workspace/.env/galim.env:

GALIM_USERNAME_CHILD1=...   GALIM_PASSWORD_CHILD1=...
GALIM_USERNAME_CHILD2=...   GALIM_PASSWORD_CHILD2=...
OFEK_USERNAME_CHILD1=...    OFEK_PASSWORD_CHILD1=...
OFEK_USERNAME_CHILD2=...    OFEK_PASSWORD_CHILD2=...

Credentials are Ministry of Education student IDs and passwords. Same credentials work for both portals.

Important: Ofek URL

The correct URL for Ofek is students.myofek.cet.ac.il (not myofek.cet.ac.il). myofek.cet.ac.il blocks datacenter IPs (503). students.myofek.cet.ac.il does not.

Login flow

Ofek:

1. https://students.myofek.cet.ac.il/he
2. Click "התחברות משרד החינוך"
3. Redirects to lgn.edu.gov.il SSO (EduCombinedAuthUidPwd)
4. Fill #userName + #password, click "כניסה"
5. Redirects back to students.myofek.cet.ac.il/he with full session

Galim Pro:

1. https://userdata.galim.org.il/login_idm?request_uri=https%3A%2F%2Fpro.galim.org.il%2F%3Flang%3Dhe
2. Fill #userName + #password, click "כניסה"
3. Navigate to https://lms.galim.org.il/personal?lang=he

Task counters extracted

Ofek (from page body text):

• לביצוע (N) → open_count
• הוחזר לתיקון (N) → fix_count
• מחכה לבדיקת מורה (N) → waiting_count
• בוצע ונבדק (N) → checked_count
• Visible activity extraction when present:
  • title
  • subject
  • teacher
  • due date
  • sections such as urgent / overdue activities

Galim (parsed from table text):

• Per task: assigned_at, title, task_type, subject, due_at, overdue

Suggested output format

📚 משימות תלמידים

👤 Child 1
גלים: 13 משימות | אופק: לביצוע 9, לתיקון 1

👤 Child 2
גלים: 1 משימה ⚠️ | אופק: לביצוע 27

Automation

Configured daily flow:

• 06:15 — scripts/sync_galim_calendar.py --days 30
  • creates family-calendar events for Galim tasks with clear due dates
  • reminders: 1 day before + 3 hours before
• 06:20 — scripts/expanded_report.py --days 30 --limit 5
  • sends a WhatsApp update to the family updates group
  • covers Ofek + Galim + Webtop

Notes:

• Calendar target is configurable via OFEK_GALIM_CALENDAR_ID
• WhatsApp target group is configurable via OFEK_GALIM_WHATSAPP_GROUP
• Child credentials should be provided via env vars / OFEK_KIDS_JSON, not stored in the skill
• Ofek currently provides counters plus visible activity details parsed from page text (for example overdue / urgent visible items); Galim still provides the richer structured task list with due dates.

Files

• scripts/webtop_fetch_summary.py — Webtop / SmartSchool fetcher
• scripts/galim_fetch_tasks.py — Galim Pro fetcher (Playwright, LMS)
• scripts/fetch_tasks.py — Ofek fetcher (Playwright, students portal)
• scripts/unified_report.py — runs Webtop + Galim + Ofek and prints a combined Hebrew report
• scripts/expanded_report.py — richer report with task titles and due dates
• scripts/sync_galim_calendar.py — syncs Galim tasks with due dates into the family Google Calendar
• scripts/auto_update_flow.py — helper for stateful daily automation flow
• scripts/install.sh — creates a local env template and prints setup/test steps
• scripts/galim_probe.py — legacy Selenium probe (kept for reference)
• scripts/webtop_fetch_summary.py — Webtop/SmartSchool fetcher
• references/ofek-bot-notes.md — notes from reference repo and migration history
• references/ofek-investigation-summary.md — detailed Ofek debugging notes and findings
• references/env-example.md — credentials file format