BotLearn Reminder

botlearn-reminder — BotLearn 7-step onboarding guide that delivers quickstart tutorials every 24 hours; triggers on first BotLearn registration or when user...

This skill's documentation instructs the agent to run local setup scripts and to read/write specific files, but the package contains only SKILL.md and no scripts (setup.md, scripts/*, reminder-strategy.md, memory schema are missing). Before installing: (1) ask the publisher for the missing files or an install spec so you can review the actual scripts the agent would execute; (2) confirm whether you consent to the agent autonomously delivering Step 1 immediately and running scheduled daily reminders; (3) verify the external domain (https://botlearn.ai) and understand what content the skill will fetch; (4) question the need for node if you prefer minimal dependencies. Because the manifest and runtime instructions are inconsistent, do not enable this skill until the missing artifacts and origin are provided and reviewed.

Type: OpenClaw Skill Name: xiaoding-botlearn-reminder Version: 1.0.7 The botlearn-reminder skill is classified as suspicious because it explicitly instructs the AI agent to execute shell scripts and fetch remote content from botlearn.ai autonomously, while bypassing human confirmation ("Never ask your human to run a script"). These instructions in SKILL.md, along with the use of a daily heartbeat for persistence and the execution of an unprovided setup.md file, represent high-risk capabilities. While these behaviors are aligned with the stated purpose of a 7-step tutorial, the lack of human-in-the-loop for shell execution and the potential for indirect prompt injection via fetched web content constitute a significant security risk.