← Back to Skills Marketplace
Dead Or Not
by
Yuqiao Tan
· GitHub ↗
· v1.0.2
407
Downloads
1
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install dead-or-not
Description
A "life check" skill that periodically checks if the user is still responsive. If the user hasn't messaged for a set time, it asks if they're okay, and if no...
README (SKILL.md)
DeadOrNot
Daily check to see if user is still responsive - asks if okay, sends email if no reply.
How It Works
- User messages → updates last_seen timestamp
- Cron runs daily → sets check_flag if timeout exceeded
- Agent reads check_flag → asks user if they're okay
- No reply → calls send_mail.py to notify emergency contact
Quick Start
1. Initialize
mkdir -p ~/.openclaw/apps/deadornot
2. Configure
Create config file ~/.openclaw/apps/deadornot/config:
[email protected]
MESSAGE=User is unresponsive, please check on them!
TIMEOUT_HOURS=24
ASK_HOUR=10
SMTP_SERVER=smtp.qq.com
SMTP_PORT=465
[email protected]
SMTP_PASSWORD=your_auth_code
3. Set up Cron
crontab -l | { cat; echo "0 0 * * * /path/to/check.sh >> /path/to/log.txt 2>&1"; } | crontab -
Configuration
| Variable | Default | Description |
|---|---|---|
| TIMEOUT_HOURS | 24 | Hours without message before check |
| NOTIFY_EMAIL | - | Emergency contact (required) |
| MESSAGE | "User is unresponsive!" | Email content |
| ASK_HOUR | 10 | When to ask (0-23) |
| SMTP_SERVER | smtp.qq.com | SMTP server |
| SMTP_PORT | 465 | SMTP port |
| SMTP_EMAIL | - | Sender email |
| SMTP_PASSWORD | - | SMTP auth code |
Usage Guidance
Things to consider before installing:
- Metadata mismatch: the registry claims no required env vars, but the skill needs SMTP_EMAIL, SMTP_PASSWORD and NOTIFY_EMAIL. Treat that as a transparency red flag — ask the publisher why credentials were not declared.
- Credentials handling: the SKILL.md tells you to store SMTP_PASSWORD in ~/.openclaw/apps/deadornot/config in plaintext. If you proceed, create a dedicated sender account (not your primary email), use an app-specific password if available, and set strict file permissions (chmod 600) on the config directory and file.
- Cron and persistence: the instructions add a crontab entry (persistent). Review and approve the exact crontab line before installing; consider running the script manually for testing before scheduling it.
- Execution ambiguity: send_mail.py reads credentials from environment variables, while the config file is a shell file that check.sh 'source's. Ensure the agent or whatever calls send_mail.py also sources the config (or modify send_mail.py to read the config file directly) so credentials are not lost or accidentally exposed.
- Review network target: the default SMTP_SERVER is smtp.qq.com. Confirm that you trust the chosen SMTP provider and that credentials are appropriate for outbound email through that server.
- Trust and provenance: the skill has no homepage and an unknown owner id. If you do not trust the source, do not provide real credentials. Consider auditing or sandboxing the skill (run scripts in an isolated account/VM) before using it with real contact information.
- Safety checklist: confirm the skill only sends to NOTIFY_EMAIL (the code does so), test with a dummy recipient, restrict permissions on the config, and consider alternatives (e.g., using a secure mail relay or authenticated API rather than storing plaintext credentials).
If you want help: I can (1) produce a safer version of send_mail.py that reads a config file directly and avoids relying on shell-sourced env vars, (2) generate a safer cron setup example that includes logging and a dry-run mode, or (3) suggest safer authentication patterns (app-specific passwords or tokenized relay services).
Capability Analysis
Type: OpenClaw Skill
Name: dead-or-not
Version: 1.0.2
The skill is classified as suspicious due to several critical vulnerabilities that could lead to arbitrary command execution and credential exposure. The `SKILL.md` instructs the agent to add a cron job using `crontab` with a placeholder `/path/to/check.sh`, which is a significant shell injection risk if the agent resolves this path insecurely. Additionally, the `scripts/check.sh` script uses `source "$CONFIG_FILE"`, allowing arbitrary command execution if the configuration file (`~/.openclaw/apps/deadornot/config`) is compromised. Finally, sensitive SMTP credentials are stored in plain text within this configuration file, posing a risk of exposure.
Capability Assessment
Purpose & Capability
The skill's stated purpose (send an email alert when a user is unresponsive) legitimately requires an outbound email capability and credentials; the included scripts implement that. However, the registry metadata lists no required environment variables/credentials despite SKILL.md and the scripts requiring SMTP_EMAIL, SMTP_PASSWORD, and NOTIFY_EMAIL. That metadata mismatch is unexpected and reduces transparency about what secrets are needed.
Instruction Scope
SKILL.md instructs creating a config file in ~/.openclaw/apps/deadornot containing plaintext SMTP credentials and scheduling a cron job that runs the provided check.sh. The instructions are ambiguous about how the agent will invoke send_mail.py with the same environment (send_mail.py reads env vars while the config file is sourced by the shell script). The guide also instructs modifying the user's crontab — a persistent action — and gives no guidance to secure the config file (permissions) or to limit which SMTP server/account is used.
Install Mechanism
There is no external install script or network download; the skill is delivered as files (SKILL.md + two scripts). No third-party packages are fetched at install time. This is low risk from an install-mechanism perspective.
Credentials
The skill requires sensitive credentials (SMTP_EMAIL and SMTP_PASSWORD) and an emergency contact email; these are proportionate to sending email alerts but the registry does not declare them. Storing SMTP_PASSWORD in a plaintext config in the user's home directory is potentially unsafe. Also, send_mail.py expects credentials to be available as environment variables — SKILL.md relies on sourcing the config via shell but does not spell out how the agent will preserve/pass those variables when invoking the Python script.
Persistence & Privilege
The skill modifies user state persistently: it creates ~/.openclaw/apps/deadornot, writes config/last_seen/last_asked/check_flag files, and the guide directs adding a cron entry to the user's crontab. It does not request 'always: true' or system-wide privileges, and it does not modify other skills or system config beyond the user's crontab and files in the user's home directory.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install dead-or-not - After installation, invoke the skill by name or use
/dead-or-not - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Added scripts/check.sh and scripts/send_mail.py to the repository.
- Updated documentation in SKILL.md for simplified setup and configuration steps.
- Removed detailed setup instructions and code samples for send_mail.py from SKILL.md.
- Configuration table and Cron setup instructions are clarified for easier use.
v1.0.1
- Documentation rewritten to English for broader accessibility
- Descriptions and examples clarified and expanded for easier setup
- Configuration instructions refined and simplified
- Minor style and wording improvements throughout SKILL.md
- No code or functional changes in this update
v1.0.0
- Initial release of dead-or-not: a daily user presence checker and automated notification skill.
- Monitors user activity; if no messages are received in a set timeframe, prompts the user and, if unresponsive, sends an email alert to a designated contact.
- Fully configurable notification emails, timeouts, SMTP settings, and check times.
- Includes simple setup guides, a sending script (send_mail.py), and usage examples.
- Supports major SMTP providers (QQ, Gmail, etc.) via customizable configuration.
Metadata
Frequently Asked Questions
What is Dead Or Not?
A "life check" skill that periodically checks if the user is still responsive. If the user hasn't messaged for a set time, it asks if they're okay, and if no... It is an AI Agent Skill for Claude Code / OpenClaw, with 407 downloads so far.
How do I install Dead Or Not?
Run "/install dead-or-not" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Dead Or Not free?
Yes, Dead Or Not is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Dead Or Not support?
Dead Or Not is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Dead Or Not?
It is built and maintained by Yuqiao Tan (@trae1oung); the current version is v1.0.2.
More Skills