by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is coherent with its description, but it requires multiple sensitive tokens and local access:
- Sensitive credentials: you must provide a Gemini API key and a Google API key, the Google OAuth client JSON path (used by gcalcli), and a Discord bot token (optional Telegram token). These grant the skill the ability to generate content (Gemini), search/fetch web resources (Google), read/write your Google Calendar (OAuth), and post messages to the configured Discord channel. Only supply ke...详细分析 ▾
✓ 用途与能力
Name/description (IELTS planning + Google Calendar + Discord) match the declared requirements: gcalcli and sqlite3 binaries, Gemini and Google API keys, Google OAuth JSON, and Discord/Telegram tokens are all reasonably required for the described features (AI-generated lessons, web search, calendar read/write, notifications, local DB).
✓ 指令范围
SKILL.md instructs the agent to: detect language/timezone, read/update workspace/IELTS_STUDY_PLAN.md and workspace/tracker/educlaw.db, call gcalcli for agenda/add, perform web searches and fetch/verify materials, and post to Discord/Telegram. These actions are within the skill's stated scope. It does read/write local OAuth credentials (~/.gcalcli_oauth) and the workspace DB — expected for calendar integration and local tracking.
✓ 安装机制
This is an instruction-only skill with no install spec or third-party downloads embedded in SKILL.md; that is the lowest-risk install pattern. The README/SETUP advise installing gcalcli/sqlite3 separately via standard package managers/pip.
✓ 凭证需求
Requested environment variables and config (GEMINI_API_KEY, GOOGLE_API_KEY, GOOGLE_OAUTH_CLIENT_JSON, DISCORD_BOT_TOKEN, DISCORD_CHANNEL_ID, optional TELEGRAM_BOT_TOKEN, plus openclaw.workspace path) are proportional to the claimed features. Each credential has a clear, documented purpose (AI generation, web search, OAuth for calendar, and notification channels).
✓ 持久化与权限
Skill is not always-enabled and does not request system-wide privileges. It writes only to its declared workspace files and the gcalcli OAuth file; autonomous invocation is allowed (platform default) but not combined with other suspicious indicators. Guardrails in SKILL.md (e.g., never delete untracked events, ask before auto-resolving conflicts) limit risky autonomous actions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/15
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install educlaw-ielts-planner
镜像加速npx clawhub@latest install educlaw-ielts-planner --registry https://cn.longxiaskill.com