by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Before installing: 1) Verify you have (or will install) obsidian-cli and are comfortable allowing the agent to run it — the skill will read and modify files in your Obsidian vault. 2) The registry metadata omits the required binary; treat that as an indicator to inspect the SKILL.md yourself. 3) The SKILL.md contains git merge conflict markers — ask the publisher for a clean, versioned source or prefer a skill with a known homepage/repo. 4) If you proceed, test with a non-sensitive vault or back...详细分析 ▾
⚠ 用途与能力
The SKILL.md clearly requires obsidian-cli (and shell date utilities) to manage Obsidian daily notes, which is consistent with the description — but the skill's registry metadata lists no required binaries or environment variables. That mismatch between declared requirements and actual runtime instructions is an inconsistency that should be resolved before trusting the skill.
ℹ 指令范围
Instructions are limited to running obsidian-cli and date commands to create/read/append notes and to prompt the user for vault configuration. They do not instruct exfiltration or access unrelated system files. However, the SKILL.md contains leftover git merge conflict markers (<<<<<<< >>>>>>>) in its header, which indicates the file wasn't cleaned up and could hide unexpected content or errors.
ℹ 安装机制
This is an instruction-only skill (no install spec). The SKILL.md tells users to install obsidian-cli via Homebrew or Scoop, which is reasonable, but the absence of an install section in the registry metadata means the runtime dependency is only documented in prose — another mismatch to verify.
✓ 凭证需求
The skill declares no environment variables or credentials and the instructions do not request secrets. It will read and write files in the user's Obsidian vault (via obsidian-cli), which is appropriate for its purpose but may expose sensitive personal notes if the user grants the agent filesystem access.
✓ 持久化与权限
The skill does not request permanent presence (always:false) and does not modify other skills or system-wide settings beyond using obsidian-cli to set a default vault if the user configures it. Note: agents are allowed to invoke skills autonomously by default; this is expected but means the agent could run these local commands without further prompts if permitted.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.12026/1/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install obsidian-daily
镜像加速npx clawhub@latest install obsidian-daily --registry https://cn.longxiaskill.com