📦 Push to Negative One Screen — 推送负一屏
v1.0.0将任务结果即时或定时推送至负一屏卡片，无需打开应用即可在桌面最左屏查看关键数据，适用于提醒、报告与监控场景。
1· 73·0 当前·0 累计
by 下载技能包
最后更新
2026/3/30
安全扫描
OpenClaw
可疑
medium confidenceThe skill largely does what it says (push task results to a Today/负一屏 endpoint) but there are packaging inconsistencies and a few behavioral choices (forced auto-push for scheduled tasks, placeholder API URL, missing declared required env in registry metadata) that warrant caution before installing.
评估建议
Before installing: 1) Confirm the AS_TODAY_API_URL points to a trusted service — the bundled default is api.example.com (placeholder). 2) Only provide an auth token (AS_TODAY_AUTH_CODE) with minimal privileges and avoid reusing high-privilege secrets. 3) Be aware scheduled tasks are configured to push immediately without asking the user; if that's undesired, do not enable automatic scheduling or modify the skill. 4) Registry metadata omits the declared required env var (AS_TODAY_AUTH_CODE) — ver...详细分析 ▾
✓ 用途与能力
Name/description, tools.json, and the included CLI code consistently implement a push-to-Today (负一屏) feature; requiring Node is expected for a Node CLI. The parameters and network call in the code align with the stated purpose.
ℹ 指令范围
SKILL.md and tools.json instruct the agent to execute node scripts/cli.js with session-derived msgId and content. SKILL.md also mandates that scheduled tasks be pushed immediately without user confirmation — this is within the skill's purpose (automation) but is a behavioral/privacy consideration (no opt-out or confirmation).
✓ 安装机制
No install spec or external downloads are present; the skill is instruction-only plus a bundled CLI script. No archive downloads or third-party installers are used.
⚠ 凭证需求
The CLI and SKILL.md require AS_TODAY_AUTH_CODE (and optionally AS_TODAY_API_URL). However, the registry-level metadata at the top of the submission lists no required env vars/primary credential — a packaging inconsistency that can cause silent misconfiguration. README references a DEBUG env var used by the code but DEBUG is not declared in SKILL.md metadata. The default API endpoint in the code is https://api.example.com/push2today (a placeholder) — you should verify the real endpoint before using the token.
✓ 持久化与权限
Skill is not always:true, does not request system-wide config paths, and does not modify other skills. It can be invoked autonomously (default), which is normal for skills; combined with the forced auto-push rule, this increases the risk of automatic pushes but is not a privilege escalation by itself.
⚠ scripts/cli.js:23
Environment variable access combined with network send.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/30
Initial release of push2today. - Enables pushing task results to the mobile "Today" screen via command-line. - Supports both immediate and scheduled (定时) push operations. - Requires authentication token (AS_TODAY_AUTH_CODE) for API access. - Provides clear parameter requirements for summary, result, content, and scheduling fields. - Enforces strict length limits and mandatory fields for scheduled tasks. - Includes comprehensive usage and configuration instructions for users.
● 可疑
安装命令
点击复制官方npx clawhub@latest install push2today
镜像加速npx clawhub@latest install push2today --registry https://cn.longxiaskill.com镜像同步中