Daily briefing: gathers today's calendar, active todos, and local weather from available workspace tools, then composes a concise summary.
Security Analysis
high confidenceThe skill's requirements and runtime instructions align with its stated purpose (orchestrating companion skills to produce a daily briefing) and it requests no unexplained credentials or installs.
The skill's name/description match its behavior: it orchestrates three companion skills (calendar, todos, weather). It does not declare any environment variables, binaries, or installs itself, and it explicitly skips missing companions — this is proportionate to a coordination/orchestration skill.
Runtime instructions are narrowly scoped: check which companion skills are available, read each companion's SKILL.md, call the companion commands (notably openmeteo CLI for weather), and compose a concise message. The skill explicitly forbids fabricating data and limits retries on failures. The only broader action is reading other skills' SKILL.md files, which is expected for an orchestrator but means the briefing's safety depends on those companions.
No install spec or code is provided (instruction-only skill), so nothing is written to disk or downloaded by the skill itself — this is the lowest-risk installation pattern.
The skill declares no required environment variables or secrets. It relies on companion tools (e.g., gcalcli requires Google OAuth configured externally, openmeteo-sh uses public API) and a default city in session context for weather; these are proportional and documented.
The skill is not forced-always-on (always:false). The README recommends using OpenClaw's cron scheduler to run briefings periodically; scheduled runs use the same agent permissions as normal sessions. This is not intrinsically dangerous, but recurring/autonomous invocation increases the impact if any companion skill is untrusted.
Guidance
This skill itself is an orchestrator and appears coherent, but before installing consider: (1) ensure you trust the companion skills it will call (gcalcli-calendar, todo-management, openmeteo-sh-weather-simple) because this briefing will read their SKILL.md and invoke their commands; a malicious companion could misuse those calls; (2) if you enable scheduled cron runs, remember those run automatically with the same agent permissions and will post output to channels you choose — limit delivery channels if necessary; (3) verify you have/give the required external configuration outside this skill (Google Calendar OAuth for gcalcli, default city in session for weather, openmeteo-sh installed if you want weather); (4) test once in an isolated session to confirm formatting and that no unexpected data is exposed. If any companion skill is untrusted or you do not want recurring automated runs, do not enable cron scheduling.
Latest Release
v2.1.0
Documentation: update cron message to match default OpenClaw's skill usage message for reliability
More by @lstpsche
Published by @lstpsche on ClawHub
