smart-auto-note

语义智能识别自动分类写入Obsidian笔记，支持待办自动归档

This skill appears to perform only local file writes (no network), but there are several red flags you should address before installing: 1) The code hardcodes BASE_DIR = '/Users/macbook/Documents/OC_club' — ask the author to make the base path configurable or confirm it will be changed to a workspace-safe location so it won't create files in an unexpected user path. 2) Metadata claims message.send and a cron trigger (onCronTick) and the HTML advertises a reminder engine, but index.js does not implement reminder logic or onCronTick; ask the author to either implement or remove those declarations. 3) The package metadata and registry version numbers conflict — request a corrected metadata.json and a clear statement of what runtime privileges/tools the skill actually needs. 4) Because the skill will write files, test it in a sandboxed environment (or point it to an empty test directory) before using with your real Obsidian vault. 5) If you rely on reminders/notifications, require the author to show the actual code path that uses message.send and explain what data will be sent. After these clarifications/repairs the skill can be reassessed; as-is the mismatches make it suspicious rather than clearly benign.

Type: OpenClaw Skill Name: smart-auto-note Version: 1.0.0 The skill bundle is a functional note-categorization tool designed to append user input to specific Markdown files (Obsidian) based on keyword matching. Analysis of index.js and SKILL.md shows no network activity, exfiltration logic, or obfuscation; file system access is restricted to a specific local directory (/Users/macbook/Documents/OC_club). While metadata.json references a cron trigger and a missing 'onCronTick' handler, these appear to be incomplete features rather than malicious backdoors.