OpenClaw Timebox

基于潘农菲翻译的《时间盒》，为 OpenClaw 打造的全天任务执行系统。早晨用一段对话规划全天、讨论优先级、锁定时间盒；执行时 AI 完全不打扰；每盒结束做 30 秒快速收集；全天结束生成每日总结并自动同步到 Flomo、Notion 等工具。支持苹果日历、飞书、Google 日历自动占位，以及将时间盒任务双向...

This skill appears coherent for a timebox workflow that syncs with calendars and task/log services. Before installing: 1) Only provide OAuth client_id/client_secret or API tokens for services you intend to use; do not paste unrelated secrets. 2) Expect the skill to write tokens/config under ~/.config/timebox and EXTEND.md under your home or project; review those files for sensitive content. 3) If opting into dida365, installing a global npm package (npm install -g @suibiji/dida-cli) is required—treat that package like any third‑party tool (check its source and reputation). 4) The included ticktick_auth.py uses a local callback server to perform standard OAuth; verify the file contents before running. 5) If you need higher assurance, run the OAuth steps manually (use official provider consoles) and keep tokens in a secure store rather than pasting them into long-lived plain files.

Type: OpenClaw Skill Name: openclaw-timebox Version: 2.7.0 The openclaw-timebox-cpr skill bundle is classified as suspicious due to its high-privilege requirements and extensive handling of sensitive credentials. Key indicators include instructions in SKILL.md for the AI to execute shell commands like 'npm install -g @suibiji/dida-cli', manage cron jobs for task reminders, and handle sensitive OAuth credentials (client IDs/secrets) by writing them into a local Python script (ticktick_auth.py). While these capabilities are aligned with the stated goal of multi-platform task synchronization (integrating with ticktick.com, feishu.cn, and notion.com), the broad request for system-level access and credential management poses a significant security risk.