Sedentary Reminder — 久坐提醒
v1.2.1久坐提醒系统设计工具，帮助设计实用的久坐休息提醒方案，包含强大的定时逻辑。
0· 124·0 当前·0 累计
by 下载技能包
最后更新
2026/4/12
安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (designing reminder logic and reminder copy) matches its instructions, but the runtime instructions expect the agent to read/write a local state file (memory/heartbeat-state.json) even though the registry metadata declares no config path — an unexplained capability that users should review before installing.
评估建议
This skill appears to do what it says (design reminders, decide timing, and generate copy), but its runtime instructions expect the agent to read and write a local state file (memory/heartbeat-state.json) even though the skill metadata does not declare that config path. Before installing, confirm: (1) where memory/heartbeat-state.json would live in your environment, (2) whether you are comfortable letting the agent read and update that file, and (3) whether the agent's filesystem permissions are...详细分析 ▾
ℹ 用途与能力
The name/description and the SKILL.md consistently describe designing timing rules, reminder copy, and user-control mappings. The declared requirements (no binaries, no env, no primary credential) are plausible for an instruction-only design tool. However, the skill repeatedly instructs reading and writing a local state file (memory/heartbeat-state.json) and integrating with a heartbeat — that file path is not declared in the registry metadata as a required config path, which is an inconsistency worth calling out.
⚠ 指令范围
SKILL.md and reference docs explicitly instruct mapping user chat commands into direct edits of memory/heartbeat-state.json and recommend exact JSON fields to read/write. Those are concrete file-read/write operations against a local state file. While consistent with implementing a reminder system, the instructions grant the agent permission to modify user state files and do not limit which fields may be changed beyond high-level guidance — this could lead to unintended overwrites if an agent runs with filesystem access. The skill does not mention any remote endpoints or credential access.
✓ 安装机制
No install spec and no code files beyond documentation — the skill is instruction-only. That is low-risk in terms of arbitrary code installation or downloads.
ℹ 凭证需求
The skill requests no environment variables or credentials, which is proportionate to the stated purpose. However, it expects read/write access to a local config/state path (memory/heartbeat-state.json) without declaring that path in registry metadata; access to that file is effectively a credential-like capability and should be declared and reviewed.
ℹ 持久化与权限
always:false and normal autonomous invocation are set (defaults). Autonomous invocation combined with instructions that edit a local state file increases potential impact if the agent has broad filesystem permissions. The skill does not request persistent installation or to modify other skills or system-wide configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.12026/4/3
Maintenance release. What's new in 1.2.1: - Removed macOS .DS_Store junk files from the published skill directory - Re-published a cleaner skill package after the 1.2.0 feature upgrade - No behavior changes to timing logic, heartbeat workflow, controls, or break detection
● 无害
安装命令
点击复制官方npx clawhub@latest install sedentary-reminder
镜像加速npx clawhub@latest install sedentary-reminder --registry https://cn.longxiaskill.com镜像同步中