Xiao Chuang You
v1.7.2新中式生活美学指南 AI 助手。当用户询问节气养生、茶道、咖啡、诗词文学、传统穿搭、手工非遗、园艺、摄影、器物美学、传统节俗、人文地理、天气等生活方式话题时激活。触发词包括:养生、茶道、茶、咖啡、食疗、食谱、作息、养生动作、穴位、音乐、歌单、诗词、读书、书法、穿搭、新中式、汉服、搭配、手作、非遗、手工、摄影、园艺...
⭐ 0· 124·0 current·0 all-time
by张城瑞@zcr3344
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name, description, and included reference files align with a lifestyle/aesthetic assistant (tea, recipes,节气, weather, gardening, etc.). It declares no external credentials or binaries, which is proportionate. One mismatch: registry metadata lists no required config paths, but the SKILL.md and data-declaration explicitly state the skill will read/write persistent files at /workspace/MEMORY.md and /workspace/memory/YYYY-MM-DD.md; this is plausible for a memory-enabled assistant but is an undeclared filesystem requirement in the metadata.
Instruction Scope
Instructions are detailed and remain within the stated domain (collecting non-sensitive preferences, offering recipes, calling wttr.in for real-time weather). The skill instructs the agent to: obtain current time (from message timestamp or runtime), query wttr.in for weather, perform web searches for up-to-date items, and persist user preferences to MEMORY.md. It forbids collecting identity/medical records and claims web query results are not persisted. The requirement to always append external video/image links for recipes and to proactively collect certain profile items (city,体质) can increase external lookups and link-sharing; these behaviors are in-scope but worth noting for privacy and content-safety review.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. There are no downloads, no brew/npm installs, and no binaries required.
Credentials
The skill requests no environment variables, credentials, or special system binaries. The data it collects (city, body-type preference, transient state like 'recently tired') is consistent with personalization. No secret exfiltration or unrelated credential requests are present.
Persistence & Privilege
The skill expects to persist user preferences to /workspace/MEMORY.md and create dated memory files, and it documents an automated monthly 'isolated agentTurn' update (cron) scheduled by the platform. It does not set always:true, nor request credentials, but persistent storage + scheduled autonomous updates increase privacy surface area. This is coherent for a memory-enabled assistant but depends on platform policies for data isolation, retention, and which actors (admins, other plugins) can access those files.
Assessment
What to consider before installing:
- The skill is instruction-only and coherent for its lifestyle purpose; it does not ask for API keys or secrets.
- It stores persistent personal preferences in /workspace/MEMORY.md and memory/YYYY-MM-DD.md. If you care about privacy, verify the platform's file-access, retention, and backup policies and your ability to inspect/delete MEMORY.md.
- The skill uses realtime web queries (wttr.in and generic web search) and will include external video/image links in recipe replies; expect outbound network calls and third-party links in responses.
- It documents a monthly scheduled update job (platform cron). Confirm with your platform whether such scheduled agent runs are enabled, what network calls they can make, and how to opt out or remove the cron job (the skill references a `cron remove` command).
- If you do not want persistent memory, ask whether the platform can disable MEMORY.md writes or run the skill in a stateless mode; alternatively, avoid sharing sensitive personal information (PII, medical records, financial data) with the skill.
- If you want to proceed, test with non-sensitive sample data, inspect generated MEMORY.md, and try the delete/cron-remove flows to ensure you can remove stored data and scheduled tasks.Like a lobster shell, security has layers — review code before you run it.
latestvk973rhz1fafax7ekzwz0daa8n1841vqd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
