OpenClaw Diary Insights

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: openclaw-diary-insights Version: 1.0.0 The skill bundle is a diary analysis tool designed to extract insights, moods, and growth metrics from local Markdown files to generate a visualization. It operates entirely on local paths (~/write_me/), uses standard shell commands for file management (mkdir, cp, open), and includes specific instructions for the AI agent to protect user privacy by desensitizing sensitive information like ID numbers or bank cards. No evidence of data exfiltration, unauthorized remote execution, or malicious intent was found in SKILL.md or the associated code.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your diary entries, moods, people, topics, and personal insights may be summarized into files that remain on disk.

Why it was flagged

The skill reads private diary files and turns them into persistent structured summaries for a local visualization.

Skill content
使用 Read 工具读取 `storage.path` 下的日记文件 ... 将 `data.js` 写入输出目录:`~/write_me/02notes/insights/data.js`
Recommendation

Use it only for diary folders you intend to analyze, review the generated output, and avoid placing the output directory in shared or synced locations unless you are comfortable exposing those summaries.

What this means

The skill will create or update local files in the insights output directory.

Why it was flagged

The skill uses shell/file operations to create an output folder and copy the visualization template.

Skill content
mkdir -p ~/write_me/02notes/insights ... cp {skill目录}/demo/insights.html ~/write_me/02notes/insights/insights-{YYYY-MM}.html
Recommendation

Check the output path before use and keep backups if you manually edit generated files.

What this means

The generated local page executes generated JavaScript data when opened in a browser.

Why it was flagged

Diary-derived data is written into a JavaScript file that the local HTML page loads as a script; this is expected for the visualization but makes correct escaping important.

Skill content
HTML 模板通过 `<script src="data.js">` 加载外部数据文件,Claude 只需要生成 `data.js`
Recommendation

Review generated data.js if your diary includes copied web content or unusual characters, and prefer JSON-safe escaping when generating the file.

What this means

Opening the generated page may contact third-party hosts, and remote scripts run in the same page that displays diary-derived data.

Why it was flagged

The local visualization depends on a remote Chart.js script, and the HTML also references Google-hosted fonts.

Skill content
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
Recommendation

For highly private diaries, consider using a locally bundled Chart.js file and local fonts or opening the page with network access blocked.