🧭 Runtime Instructions Control Plane
v0.1.0Load per-job runtime instructions from Google Sheets, cache them locally, and reconcile cron job enablement flags safely for OpenClaw operations.
0· 44·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and README largely match the stated purpose (reading a Google Sheet and toggling cron job enabled flags), but the registry metadata omits required credentials and there are small mismatches in auth expectations that deserve caution before use.
评估建议
This package appears to do what it says, but pay attention before you run it: (1) The skill needs GOOGLE_SHEETS_SPREADSHEET_ID and authentication — either a Google service-account private key (GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY) or an authenticated gcloud CLI for token fallback. The registry metadata does not list these, so don't rely on the registry summary. (2) The reconcile script will modify your local OpenClaw cron jobs JSON (default ~/.openclaw/cron/jobs.json) — test with the dry-run first...详细分析 ▾
ℹ 用途与能力
The scripts do exactly what the name/description claim: fetch instructions from Google Sheets, cache them under the OpenClaw runtime directory, and reconcile cron job enabled flags. Required runtime (node) and the Google Sheets access are proportional to the stated purpose. However, the published registry metadata lists no required environment variables or primary credential while SKILL.md and the scripts clearly require GOOGLE_SHEETS_SPREADSHEET_ID and either service-account credentials or a gcloud token — this mismatch is an inconsistency in the package metadata.
ℹ 指令范围
SKILL.md and the included scripts are explicit about what they do: call Google Sheets APIs, write JSON/MD cache files, and update a local cron jobs.json (with timestamped backups in apply mode). The loader falls back to cached files when network/auth is unavailable and may shell out to gcloud to obtain an access token. No code attempts to read unrelated system config or post data to unexpected external endpoints beyond Google APIs. Minor scope difference: reconcile-cron requires service-account creds (no gcloud fallback), while load-sheet-instructions supports either — this should be documented clearly to avoid runtime surprises.
✓ 安装机制
This is instruction-only with included Node scripts and no install spec. Nothing is automatically downloaded or executed during install; the user must run the scripts with node. That limits supply-chain risk compared with an arbitrary remote install, but users will execute the local scripts, so review before running is recommended.
ℹ 凭证需求
The scripts legitimately require GOOGLE_SHEETS_SPREADSHEET_ID and either GOOGLE_SERVICE_ACCOUNT_EMAIL / GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY or a gcloud-authenticated token. These environment variables are sensitive (private key) but are proportionate to accessing spreadsheets. The registry metadata's omission of these required env variables and the 'primary credential: none' field is misleading and reduces transparency. Also note the scripts write to and modify the local jobs.json (default ~/.openclaw/cron/jobs.json) — that file access is required for the reconcile task but is a privileged local change you should permit intentionally.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. It writes its own cache files and, when run with --apply, modifies the OpenClaw jobs.json (and creates a timestamped backup). This behavior is aligned with the control-plane purpose and does not alter other skills or system-wide agent settings.
⚠ scripts/load-sheet-instructions.mjs:8
Environment variable access combined with network send.
⚠ scripts/reconcile-cron-from-sheet.mjs:6
Environment variable access combined with network send.
⚠ scripts/load-sheet-instructions.mjs:199
File read combined with network send (possible exfiltration).
⚠ scripts/reconcile-cron-from-sheet.mjs:107
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/4/7
Initial release: Google Sheets runtime-instructions loader + cron enablement reconciler with local cache fallback and configurable paths.
● 无害
安装命令 点击复制
官方npx clawhub@latest install runtime-instructions-control-plane
镜像加速npx clawhub@latest install runtime-instructions-control-plane --registry https://cn.clawhub-mirror.com
技能文档
Use this skill to run OpenClaw jobs from a Google Sheet control plane without editing cron/jobs.json manually.
What this provides
- Fetches per-job instructions from Google Sheets and writes local runtime cache files.
- Supports local-only fallback from cache when Sheets or auth is unavailable.
- Reconciles cron job
enabledflags from sheet rows in dry-run or apply mode. - Includes a schema reference and starter CSV template for sheet setup.
Included files
scripts/load-sheet-instructions.mjsscripts/reconcile-cron-from-sheet.mjsreferences/google-sheet-instructions-schema.mdtemplates/job_instructions_template.csv
Environment
Set these before running:GOOGLE_SHEETS_SPREADSHEET_IDGOOGLE_SHEETS_RANGE(optional, default in scripts)- Either service account creds:
GOOGLE_SERVICE_ACCOUNT_EMAIL
- GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY
- Or authenticated
gcloudfor token fallback in loader script.
Optional path overrides:
OPENCLAW_ROOT(default:~/.openclaw)OPENCLAW_RUNTIME_INSTRUCTIONS_DIR(default:$OPENCLAW_ROOT/memory/runtime-instructions)OPENCLAW_CRON_JOBS_PATH(default:$OPENCLAW_ROOT/cron/jobs.json)
Usage
Load one job's runtime instructions:
node scripts/load-sheet-instructions.mjs \
--job-id "" \
--job-name ""
Load from cache only (no network):
node scripts/load-sheet-instructions.mjs --job-id "" --local-only
Preview cron enable/disable changes from sheet:
node scripts/reconcile-cron-from-sheet.mjs
Apply cron enable/disable changes:
node scripts/reconcile-cron-from-sheet.mjs --apply
Safety notes
- Always run dry-run first before
--apply. - Reconcile script creates a timestamped backup before writing
jobs.json. - Keep this focused on operational control-plane toggles, not content generation.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制