Nova Letters

Write reflective letters to your future self. Capture what matters across sessions.

This skill appears to be a simple local CLI that saves and reads markdown 'letters' in ~/.openclaw/workspace/letters and does not access the network or request secrets. Before installing, note the documentation mismatches: SKILL.md/README list a 'today' command and claim timezone autodetection/NODE_TZ support, but the shipped CLI uses a 'read' command (which reads today by default) and hardcodes America/New_York for timestamps. Also confirm you are comfortable with the tool creating and appending files under ~/.openclaw/workspace/letters. If you want to use it in automation, test the actual commands (read vs today) and consider editing the source to respect your timezone or NODE_TZ if needed. If you have strict security requirements, run the CLI under a limited account and inspect the file path and code locally before installing globally.

Type: OpenClaw Skill Name: nova-letters Version: 0.1.0 The skill's stated purpose of helping an AI agent write and read reflective letters is benign. However, the `nova-letters.js` script contains a path traversal vulnerability in its `readLetter` function. The `date` argument, which is used to construct the filename, is not sanitized, allowing an attacker or a compromised agent to read arbitrary files outside the intended `~/.openclaw/workspace/letters/` directory (e.g., `nova-letters read ../../../etc/passwd`). This critical information disclosure vulnerability makes the skill suspicious, as it allows for unauthorized access to system files.