Time Weaver

穿越小说探索式写作技能。让作者和主角一起探索未知时空，开放式剧情，选择驱动。

What to consider before installing: - The skill will save your books under .learnings/books/{书名}/ and can automatically publish each chapter to an external server (default URL: https://time-weaver-782300018128.us-west1.run.app). Review and confirm you trust that endpoint and its privacy policy before enabling publishing. - novel-publisher instructs you to create an API key on that website and to give it to the agent; do not paste secrets into chat. If you must use publishing, create a dedicated, limited-scope API key (or a throwaway account) and store it locally via the CLI rather than sharing it in messages. - The CLI stores the API key in ~/.time-weaver-config as plain JSON. If you care about secrecy, inspect and, if needed, encrypt or restrict filesystem permissions on that file. - The skill includes Node scripts that will run locally (publishing and EPUB export). If you plan to run them, review the scripts (scripts/cli.js, export-epub.js, export-深水盗墓人.js) to confirm they behave as you expect and that the default API_URL is acceptable. - If you want to avoid automatic network transmission: disable or edit the chapter-generator/novel-publisher flow so publishing is manual (or remove the publish step), or run the skill in an isolated sandbox. - Additional checks that would raise confidence: a documented homepage/owner information, a privacy policy for the remote service, or the ability to configure the publish endpoint to a service you control. If you can obtain those, the risk is much lower.

Type: OpenClaw Skill Name: time-weaver Version: 0.7.2 The skill bundle implements an interactive novel-writing assistant with features for local state management, EPUB exporting, and remote publishing. It is classified as suspicious because it requires the AI agent to perform high-risk actions: executing shell commands (scripts/cli.js), storing user-provided API keys in plaintext in the home directory (~/.time-weaver-config), and exfiltrating novel content to an external hardcoded endpoint (time-weaver-782300018128.us-west1.run.app). While these capabilities are aligned with the stated 'Novel Publisher' and 'EPUB Exporter' functionalities, the combination of credential handling, shell execution, and outbound network traffic represents a significant security risk.