每日定时任务：从 computer_io 文件夹读取剪贴板和通知数据，写入每日 memory。

What to check before installing or running this skill: - Path behavior: The script hardcodes /Users/wutianfu/.openclaw/... which will not work correctly for other users and could read another user's files on a shared system. Change the script to use $HOME or a relative workspace path before use. - Privacy: The skill reads local clipboard and notification files (sensitive personal data). Only run it if you trust the environment and you are comfortable with those files being processed into a daily summary. - Contacts claim: The script claims to 'update contacts' but it only extracts matches to a temporary file and deletes it. If you expect contact database changes, inspect and modify the script to explicitly and safely write to your contacts store. - Cron/scheduling: SKILL.md says a cron job is configured but there's no install step that configures it. Verify ~/.openclaw/cron/jobs.json yourself if you want automatic scheduling, or set up your own scheduler. - Test safely: Run the script in a sandbox or on a copied subset of your workspace first to confirm behavior. Review and sanitize the grep/regex patterns to avoid accidental capture of unrelated sensitive strings (e.g., emails, tokens). - Least privilege: Run the script with the minimal user account that owns the memory workspace. If you don't want the skill to run autonomously, avoid enabling automatic scheduling or restrict agent invocation. If you want, I can suggest a corrected version of the script that uses $HOME, properly updates contacts when requested, and documents expected input/output paths.

Type: OpenClaw Skill Name: daily-memory-summary Version: 1.0.0 The skill aggregates highly sensitive information, including clipboard history and system notifications, into a centralized 'memory' file. While it lacks explicit exfiltration logic, the script `summarize.sh` contains hardcoded absolute paths for a specific user (`/Users/wutianfu/`) and utilizes specific regex patterns to target corporate data (e.g., `lenovo.com`, 'Brad', and 'DT'). This targeted data collection and the inherent privacy risks of automated clipboard/notification harvesting make the bundle suspicious, despite its stated purpose as a journaling tool.