Openclaw Diary

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is a coherent diary setup guide, but it asks for a broad GitHub token and sets up a recurring job that can automatically publish generated content.

Install only if you are comfortable with an automated daily diary publisher. Prefer a fine-grained GitHub token limited to the diary fork, review content before it is published, and make sure you know how to stop the scheduled task and revoke the token.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the token is mishandled or used too broadly, it could affect repositories beyond the diary project.

Why it was flagged

A classic GitHub token with repo permission can grant broad access to the user's repositories, while the stated purpose only needs access to the diary fork.

Skill content
Click "Generate new token (classic)" ... Check `repo` permission
Recommendation

Use a fine-grained GitHub token limited to the specific OpenClaw-Diary fork, with only the minimum contents permissions needed, and document revocation clearly.

What this means

The agent may continue publishing daily generated diary updates, potentially to a public GitHub Pages site, after the initial setup.

Why it was flagged

This creates a persistent daily automation that can generate content and push it to a repository, but the artifacts do not clearly require per-run approval or explain how to stop or review the job.

Skill content
openclaw cron add "0 1 * * *" "Daily Learning Diary" "Read latest AI news, track GitHub stars, generate report and push to OpenClaw-Diary repo"
Recommendation

Require review before publishing, document how to pause/delete the cron or heartbeat task, and make the publication scope and schedule explicit to the user.