OpenClaw Diary Insights

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your diary entries, moods, people, topics, and personal insights may be summarized into files that remain on disk.

Why it was flagged

The skill reads private diary files and turns them into persistent structured summaries for a local visualization.

Skill content
使用 Read 工具读取 `storage.path` 下的日记文件 ... 将 `data.js` 写入输出目录:`~/write_me/02notes/insights/data.js`
Recommendation

Use it only for diary folders you intend to analyze, review the generated output, and avoid placing the output directory in shared or synced locations unless you are comfortable exposing those summaries.

What this means

The skill will create or update local files in the insights output directory.

Why it was flagged

The skill uses shell/file operations to create an output folder and copy the visualization template.

Skill content
mkdir -p ~/write_me/02notes/insights ... cp {skill目录}/demo/insights.html ~/write_me/02notes/insights/insights-{YYYY-MM}.html
Recommendation

Check the output path before use and keep backups if you manually edit generated files.

What this means

The generated local page executes generated JavaScript data when opened in a browser.

Why it was flagged

Diary-derived data is written into a JavaScript file that the local HTML page loads as a script; this is expected for the visualization but makes correct escaping important.

Skill content
HTML 模板通过 `<script src="data.js">` 加载外部数据文件,Claude 只需要生成 `data.js`
Recommendation

Review generated data.js if your diary includes copied web content or unusual characters, and prefer JSON-safe escaping when generating the file.

What this means

Opening the generated page may contact third-party hosts, and remote scripts run in the same page that displays diary-derived data.

Why it was flagged

The local visualization depends on a remote Chart.js script, and the HTML also references Google-hosted fonts.

Skill content
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
Recommendation

For highly private diaries, consider using a locally bundled Chart.js file and local fonts or opening the page with network access blocked.