Ticket Monitor Ichinosuke

Monitors 春風亭一之輔's official site for new Tokyo performance tickets and sends notifications to a specified Discord webhook.

Security Scan

The skill's code and instructions generally match its stated purpose (scrape an artist site and post to a Discord webhook), but there are inconsistencies and deployment instructions that broaden its access (notably asking you to put the webhook into the OpenClaw global .env) and an installer flag that can modify system packages — you should review and limit how the webhook secret is stored before installing.

Purpose & Capability

Name/description (monitor Ichinosuke site and notify Discord) align with the included Python scraper and a notify_discord function. However, registry metadata at the top of the package claimed 'Required env vars: none' while the SKILL.md frontmatter and the script require DISCORD_WEBHOOK_URL — a clear metadata mismatch that should be fixed.

Instruction Scope

SKILL.md instructs operators to edit OpenClaw's top-level docker-compose .env (global OpenClaw config) to add DISCORD_WEBHOOK_URL and restart containers. That expands the secret's scope to the entire OpenClaw process (all skills) rather than keeping it limited to this skill or a skill-specific config. Aside from that, the runtime instructions and script only perform scraping of the target site and POSTs to the provided Discord webhook; they do not read unrelated credentials or system secrets.

Install Mechanism

There is no remote code download — the package is instruction+script based and includes scripts/install.sh which runs pip install requests beautifulsoup4 python-dotenv. The install script uses the flag --break-system-packages as the first pip argument (then falls back), which on some systems (Debian/Ubuntu with system Python packaged) can be risky or indicate it will alter system-managed packages. This is not unusual for a Python script but worth noting.

Credentials

Only one secret is used (DISCORD_WEBHOOK_URL), which is proportional to the function. However the package documentation explicitly tells operators to place that webhook into the global OpenClaw .env, which increases exposure: the webhook becomes readable/usable by other skills and processes that read that environment. Also the top-level registry metadata omitted this required env var, creating confusion.

Persistence & Privilege

The skill does not set always:true and only writes a local seen_tickets.json under the skill's data directory, which is appropriate. The concern is the recommended deployment step to modify OpenClaw's global .env — that effectively grants the skill's webhook value broader presence across the agent runtime and increases blast radius if the secret is compromised. The skill does not modify other skills or system-wide agent settings itself, but the installation guidance asks the operator to do so.

What to consider before installing

What to check before installing: - Metadata mismatch: the registry metadata declared no required env vars but SKILL.md and the script require DISCORD_WEBHOOK_URL — confirm this and update metadata before installing. - Do NOT put your Discord webhook secret into a global OpenClaw .env unless you accept that other skills/processes could access it. Prefer storing the webhook in a skill-specific .env mounted only into the skill folder, use a secrets manager, or pass it at runtime if the platform supports per-skill secrets. - Review scripts/install.sh: it runs pip install and attempts --break-system-packages first. If you're running in a production container, prefer installing dependencies into a virtualenv, image build step, or Dockerfile to avoid changing host/system packages. - Verify the webhook channel permissions: create a dedicated webhook with minimal permissions and a dedicated channel for notifications to limit impact if the webhook leaks. - Confirm the scraper behavior is acceptable (rate limits, robots.txt, target URLs) and that the skill will not run at a frequency that could trigger rate limits or blocking. - Inspect and control file write location: the script writes data/seen_tickets.json under the skill directory. Ensure directory permissions are appropriate and the data directory is not world-readable if that matters. - If you need lower blast radius, consider running this skill in an isolated container where the webhook env is supplied only to that container, or modify the skill to accept the webhook as an explicit argument rather than requiring global env changes. Given these points, the package appears to implement the stated functionality, but the deployment guidance increases secret exposure and the metadata inconsistency should be resolved — treat the package as suspicious until you confirm safe deployment practices.

Ticket Monitor - 春風亭一之輔

春風亭一之輔の公式ウェブサイト（いちのすけえん）をスクレイピングし、東京都内で開催される新しい公演チケット情報を検知して指定のDiscordに通知するツールです。

必要な依存関係 (Dependencies)

このスクリプトを実行するには、Python 3と以下の外部パッケージが必要です。

• requests
• beautifulsoup4
• python-dotenv

事前に以下のコマンドでインストールしてください。

pip install requests beautifulsoup4 python-dotenv

インストールと設定

環境変数として、通知先のDiscord Webhook URLの設定が必要です。 Docker・VPSでOpenClawを稼働している場合、以下の手順でOpenClaw大元の設定ファイルに直接環境変数を追加してください。

【VPS / Docker コンテナ環境での設定手順】

1. VPSにログインし、OpenClaw本体の docker-compose.yml が置かれているディレクトリに移動します。
2. ディレクトリ内にある設定ファイル（.env）を開きます。
3. ファイルの末尾に、以下の環境変数を追記して保存します。

   DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
   

4. リロードするために、コンテナを一度停止して再起動します。

   docker compose down
   docker compose up -d
   

利用方法

OpenClawエージェントに対して以下のように指示してください。

• 「春風亭一之輔の新しいチケット情報がないか確認して」
• 「一之輔の東京公演をチェックして」

エージェントは自律的に scripts/ticket_monitor.py を実行し、前回確認時からの差分（新規公演情報）のみをDiscordに通知し、実行結果をチャットで返答します。

セキュリティ・プライバシー

• 外部APIへの通信: 通知の送信用に提供されたDiscord Webhook URLに対してPOSTリクエストを送信します。
• データの保存: data/seen_tickets.json に既読の公演ID（URLまたはテキスト）をローカルに保存し、差分検知に使用します。