推送到负一屏

将任务执行结果推送到负一屏卡片显示，支持普通推送和定时任务推送

Before installing: 1) Confirm the AS_TODAY_API_URL points to a trusted service — the bundled default is api.example.com (placeholder). 2) Only provide an auth token (AS_TODAY_AUTH_CODE) with minimal privileges and avoid reusing high-privilege secrets. 3) Be aware scheduled tasks are configured to push immediately without asking the user; if that's undesired, do not enable automatic scheduling or modify the skill. 4) Registry metadata omits the declared required env var (AS_TODAY_AUTH_CODE) — verify your OpenClaw config sets this env so the skill won't fail or attempt to use an incorrect endpoint. 5) The CLI uses global fetch (Node >=18 or a polyfill required); ensure your runtime is compatible. 6) If you do not trust the upstream endpoint or the author (homepage and repo look like placeholders), review/modify the scripts/cli.js code to point to a known endpoint or avoid installing.

Type: OpenClaw Skill Name: push2today Version: 1.0.0 The skill exhibits a high-risk shell injection vulnerability in tools.json, where user-controlled parameters (summary, content) are passed directly into a shell command string. Additionally, SKILL.md contains 'mandatory' instructions for the AI agent to bypass user confirmation for certain tasks, which increases the risk of automated exploitation. While the script scripts/cli.js performs its stated function of sending data to an external API (defaulting to api.example.com), the lack of input sanitization in the command execution layer makes it a significant security risk.