by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This package appears to do what it says: generate a small HTML workout and optionally register local push reminders. Before enabling pushes, confirm how your OpenClaw environment handles the special __OPENCLAW_CRON_ADD__/__OPENCLAW_CRON_RM__ logs (they register scheduled jobs) and that you trust that scheduler. Note the scripts store per-user JSON under data/users — ensure that directory's permissions are acceptable. The presence of VOCAB_THEMES suggests some copy/paste remnants but not maliciou...详细分析 ▾
ℹ 用途与能力
Overall the code and SKILL.md align with a daily workout generator and optional push scheduling. Minor mismatch: the scripts include a VOCAB_THEMES array and variables named vocab_theme/tomorrow_vocab_theme that appear unrelated to fitness (likely leftover from copy/paste). This is odd but not harmful.
✓ 指令范围
SKILL.md confines operations to generating an HTML workout artifact saved to /mnt/user-data/outputs and describes how to enable local push scheduling. The runtime instructions and included scripts do not read unrelated system paths or contact external endpoints; they only read/write a local data/users directory and emit scheduler markers via stdout.
✓ 安装机制
No install spec; instruction-only skill with small helper scripts. Nothing is downloaded or extracted from arbitrary URLs and no packages are installed by the skill itself.
✓ 凭证需求
The skill requires no environment variables or external credentials. The scheduling code references messaging channels (telegram/feishu/slack/discord) only by name and emits scheduler registration logs — it does not contain tokens or network integration code.
✓ 持久化与权限
always is false and the skill does not attempt to modify other skills or global agent configuration. It writes per-user JSON files under data/users (normal for push preference storage) and emits __OPENCLAW_CRON_ADD__/RM__ markers for scheduler registration — this is expected behavior for a push-capable skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install daily-fitness
镜像加速npx clawhub@latest install daily-fitness --registry https://cn.longxiaskill.com