Skylight

Interact with Skylight Calendar frame - manage calendar events, chores, lists, task box items, and rewards. Use when the user wants to view/create calendar events, manage family chores, work with shopping or to-do lists, check reward points, or interact with their Skylight smart display.

This skill appears to do what it claims (talk to the Skylight API), but there are a few red flags you should consider before installing or using it: - Metadata mismatch: The registry only lists SKYLIGHT_FRAME_ID and SKYLIGHT_EMAIL, but the runtime instructions require SKYLIGHT_PASSWORD or SKYLIGHT_TOKEN (and optionally SKYLIGHT_URL). Treat that as sloppy or incomplete metadata — verify expected env vars before supplying credentials. - Credentials exposure: The recommended flow logs in with your email and password to obtain a token. Only use this with accounts you control. Prefer using a pre-captured token or a scoped credential if possible, and rotate your password/token after testing. - Proxy token-capture guidance: The skill suggests using an HTTPS proxy and trusting a root certificate to capture tokens. Installing/trusting a root cert is risky and can expose all HTTPS traffic on your machine — avoid this unless you fully understand the risks and trust the environment. - Undeclared tools: Examples call jq and base64 but the skill metadata only required curl. If you run these commands locally, ensure you understand what each command does and that you have the expected tooling. - Source verification: The skill source is 'unknown' in the registry. Check the skill author/publisher identity and prefer an official or well-audited implementation. If you must use it, limit usage to a test account, monitor network traffic, and rotate credentials after use. If you want to proceed: prefer supplying only a pre-captured token with minimal scope, avoid following the MITM proxy instructions unless necessary, and verify the skill's metadata and source first.

Type: OpenClaw Skill Name: skylight-skill Version: 1.0.0 The skill is designed to interact with the unofficial Skylight Calendar API. It requires environment variables like `SKYLIGHT_EMAIL`, `SKYLIGHT_PASSWORD`, and `SKYLIGHT_FRAME_ID` to authenticate and make API calls to `https://app.ourskylight.com`. The `SKILL.md` file details the authentication process, which involves sending credentials to the legitimate Skylight API endpoint via `curl` to obtain an authorization token. All network requests are directed to the stated `ourskylight.com` domain. There is no evidence of data exfiltration to unauthorized third parties, malicious code execution, persistence mechanisms, or prompt injection attempts to subvert the agent's instructions. The use of `curl` and `jq` is standard for API interaction and aligns with the skill's stated purpose.