经期管理 / Period Tracker

经期管理 / Period Tracker - 女性健康周期追踪工具。全自然语言交互，无需记命令。功能：(1) 经期记录 - 说'月经来了'即可记录；(2) 症状记录 - 说'痛经2级'或'心情烦躁'；(3) 周期预测 - 说'下次月经什么时候'；(4) 排卵期管理 - 受孕概率日历；(5) 定时提醒 - 说'帮...

What to consider before installing: - Privacy: all health data is stored locally at ~/.openclaw/workspace/period_tracker/data.json; it is not uploaded by the code. If you want stronger protection, back up/encrypt or delete the file when not needed. - Crontab changes: the reminder script reads and rewrites your user crontab to add scheduled notifications. Review the exact cron lines before allowing setup and be aware it will run the script as your user at scheduled times. - Local commands: the code may invoke 'crontab' and (optionally) 'clawhub' to check updates. If you do not have clawhub installed, that call is wrapped in try/except and will silently do nothing. If you do have clawhub, update-check behavior will run the local binary — consider whether you trust that tool. - Version mismatch: registry metadata shows 1.2.0 while the script's CURRENT_VERSION is 1.1.0 — not a security issue by itself but indicates maintenance/versioning inconsistency you may want to confirm. - Audit before enabling: inspect the cron entries that will be added and the data file contents if you have sensitive notes. If you only want ephemeral use, avoid enabling persistent reminders or delete cron entries after use. Overall this appears coherent and consistent with a local period-tracker; the primary risks are local (crontab modification and storage of sensitive health data) rather than unexplained network or credential access.

Type: OpenClaw Skill Name: period-tracker Version: 1.2.0 The skill implements period tracking with automated reminders and self-update capabilities. It achieves persistence by modifying the user's crontab via `scripts/setup_reminder.py` and includes a self-update mechanism in `scripts/period_tracker.py` that executes `clawhub update`. While these behaviors are documented and support the skill's stated functionality, the manipulation of system-level scheduling and the ability to trigger external updates represent high-risk capabilities that warrant a suspicious classification under the provided criteria.