Scan Report
0 /100
daily-poem
Daily Poem — 每日精选诗词推送，中英古典/现代诗交替，含译文赏析朗读节奏，支持按主题/作者按需查诗和周合辑
Daily Poem skill is a legitimate poetry delivery and query service using Node.js scripts as prompt generators with minimal filesystem access and no network/shell execution.
Safe to install
This skill is safe to use. No security concerns identified.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | SKILL.md:data/push-log.json; scripts read this file only |
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md declares push-log.json writes; scripts use fs.readFileSync (read-only),… |
| Network | NONE | NONE | — | No network requests in any script |
| Shell | NONE | NONE | — | No shell execution, subprocess, or command invocation |
| Environment | NONE | NONE | — | No env access found |
| Browser | NONE | NONE | — | Not used |
File Tree
8 files · 19.1 KB · 542 lines JavaScript 4f · 391L
Markdown 1f · 122L
JSON 3f · 29L
├─
▾
data
│ └─
push-log.json
JSON
├─
▾
scripts
│ ├─
morning-push.js
JavaScript
│ ├─
push-toggle.js
JavaScript
│ ├─
query.js
JavaScript
│ └─
weekly-digest.js
JavaScript
├─
_meta.json
JSON
├─
package.json
JSON
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
none | N/A | npm | No | No external dependencies — only built-in Node.js modules (fs, path, process) |
Security Positives
✓ SKILL.md documentation accurately describes all script functionality with no mismatches
✓ Scripts are simple prompt generators outputting to console only — no side effects
✓ query.js implements input sanitization (removes <>&"';&|`$ characters)
✓ No external dependencies — uses only built-in Node.js modules (fs, path, process)
✓ Filesystem access is minimal: only reads/writes push-log.json within skill directory
✓ No credential access, sensitive path access, or environment variable reading
✓ No network requests, IP connections, or data exfiltration
✓ No obfuscation, base64-encoded strings, or anti-analysis techniques
✓ Cron management is documented as openclaw CLI commands, not raw shell scripts
✓ push-toggle.js only prints instructions without executing system commands