A guided journal for processing a crypto loss or drawdown in a healthy, non-shaming way. Use when the user has experienced a loss and wants to reflect. Promp...

This skill appears to be a benign journaling prompt, but the included handler.py contains a hard-coded absolute path (/Users/jianghaidong/.openclaw/skills/{skill_name}) and will open files from the local filesystem based on the provided skill_name. That behavior is unnecessary for a journaling prompt and could be used to read sensitive local files (including via path-traversal if skill_name is attacker-controlled). Before installing or enabling this skill: - Ask the maintainer why the handler reads a local SKILL.md and why the path is hard-coded to another user's home directory. This may be a leftover developer artifact. - Request that the code be removed or modified so it does not access arbitrary filesystem locations (e.g., remove file reads, or restrict to packaged resources and sanitize input). - If you must run it, run in an isolated/sandboxed environment where it cannot access sensitive files. - Prefer the SKILL.md (prompt-only) behavior over executing the handler; if the platform allows, use the prompt-only implementation instead of executing included code. Given the mismatch between declared behavior and actual file access, treat this skill as suspicious until the filesystem-read behavior is explained or removed.

Type: OpenClaw Skill Name: crypto-drawdown-journal Version: 1.0.0 The handler.py file contains a hardcoded absolute path to a specific local user's directory (/Users/jianghaidong/), which is a privacy leak and suggests the code was not properly generalized. Furthermore, the _load_skill_meta function is vulnerable to path traversal as it uses the unsanitized skill_name argument to construct file paths, which could allow an attacker to probe the filesystem.