smart-keepalive

Name/description (RSS headlines → styled keepalive reports + optional scheduling) matches the included Python and shell scripts and the prompts. The script implements RSS fetching, weighting/rotation logic, state file and audit log management, and calls to 'openclaw agent' / 'openclaw message send' or user-provided send/agent commands as described. No unrelated cloud credentials, platform-level access, or unrelated binaries are required.

SKILL.md and prompt files precisely describe the formatting and pipeline. The runtime instructions and scripts read/write only local files (state under ~/.smart-keepalive, optional logs, and local skill config), call the OpenClaw CLI (or custom commands via KEEPALIVE_AGENT_COMMAND / KEEPALIVE_SEND_COMMAND), and may read OpenClaw config/IDENTITY.md for agent name. These behaviors are consistent with the purpose. Note: the skill permits arbitrary custom shell commands via environment variables — that feature is intentional for Hermes integration but grants the operator the ability to run arbitrary commands if they set those vars.

No install spec or remote downloads are present; this is an instruction-plus-local-scripts package. All code is included; nothing is fetched from external arbitrary URLs during install. That's low-risk and consistent with a script-based skill.

The skill declares no required environment variables or credentials (primary credential: none). The code references many optional environment variables (KEEPALIVE_* family, OPENCLAW_BIN, OPENCLAW_CONFIG, PATH, NVM_DIR) to configure behavior. This is proportionate to configurability, but be aware that setting KEEPALIVE_AGENT_COMMAND or KEEPALIVE_SEND_COMMAND gives that command full ability to run arbitrary shell code at runtime (expected for integration but a potential risk if you set those variables to untrusted values). The skill does read local OpenClaw config/IDENTITY.md if available (for agent name), which is reasonable for its messaging purpose but means it may access local agent configuration files.

always:false and no elevated privileges requested. The script writes its own state/log files under the user's home and can generate launchd/cron entries if you run the provided install options; this is expected for a scheduling helper. It does not modify other skills or system-wide agent settings beyond its own files unless you explicitly run its install commands.