职场摸鱼党福音！每天说“今天摸鱼了”，自动统计摸鱼时长、心得吐槽、伪装工作日志、周排行榜。幽默解压，社死级生产力伪装。
Security Analysis
medium confidenceThe skill's functionality (local journaling and humor) is coherent, but the runtime instructions ask the agent to read chat history, browser history and calendars and to write files under ~/.openclaw without those permissions being declared in the registry metadata — a privacy-related mismatch you should review before installing.
The stated purpose (local 'moyu' journaling, summaries and a boss-friendly log) matches the actions the skill describes (writing per-day JSON files and producing summaries). However, the SKILL.md explicitly requires filesystem write access and optional access to chat history, browser history and calendar data; the registry metadata (Requirements) lists no required config/permissions. That mismatch between declared metadata and runtime instructions is a coherence gap.
SKILL.md instructs the agent to: (1) create/append files at ~/.openclaw/moyu-journal/, (2) compute summaries by reviewing 'day chat history', 'browser history (if allowed)', and 'calendar events'. Accessing chat history, browser history and calendar is broader and more privacy-sensitive than simple local journaling. These accesses are plausible for the stated purpose but are not limited or explicitly constrained in the instructions (e.g., no explicit minimization, no opt-in flow described).
This is an instruction-only skill with no install spec and no included executable code. That reduces risks associated with downloading/executing remote code. There are no third-party packages or external installers declared.
No environment variables or external credentials are requested (good), but the skill requires filesystem access and optional access to memory/chat, browser history and calendar tools. Those are sensitive capabilities for a light entertainment/journaling skill and should be explicitly declared in registry metadata and confirmed with the user at install time. The SKILL.md claims 'all data local' which is reassuring, but the mention of a paid cloud-backup add-on raises an explicit path that could change data handling if enabled.
The skill is not marked 'always:true' and does not request permanent elevated platform privileges. Its persistence is limited to writing files in the user's home directory under ~/.openclaw/moyu-journal/, which is consistent with its stated purpose. It does not declare changes to other skills or global agent settings.
Guidance
This skill appears to be what it says (a humorous local journal) but it requires filesystem write access and asks to read chat history, browser history and calendar events to infer activities — these can contain sensitive information. Before installing: (1) confirm the platform will prompt you for filesystem and memory/browser/calendar permissions and that you can deny them; (2) if you only want basic journaling, refuse browser/calendar access; (3) inspect the actual files under ~/.openclaw/moyu-journal/ after use to verify contents; (4) be cautious about enabling any optional cloud backup paid feature (it changes the local-only promise); and (5) if you want stronger guarantees, ask the author for an explicit privacy description or for the skill to declare required permissions in the registry metadata. If you are uncomfortable granting access to chat/browser/calendar history, do not enable those tools for this skill.
Latest Release
v1.0.0
- 初始版本发布：摸鱼日记自动整理器 1.0.0 - 支持用自然语言快速记录每日摸鱼时长、内容与心得 - 自动统计当天总摸鱼时长，并输出幽默风格总结 - 提供“老板版”高效工作日志伪装功能 - 支持一键生成本周摸鱼排行榜与活动Top3 - 本地数据存储，保护用户隐私
More by @swiftuis
Published by @swiftuis on ClawHub
