← 返回 Skills 市场
Dead Or Not
作者
Yuqiao Tan
· GitHub ↗
· v1.0.2
407
总下载
1
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install dead-or-not
功能描述
A "life check" skill that periodically checks if the user is still responsive. If the user hasn't messaged for a set time, it asks if they're okay, and if no...
使用说明 (SKILL.md)
DeadOrNot
Daily check to see if user is still responsive - asks if okay, sends email if no reply.
How It Works
- User messages → updates last_seen timestamp
- Cron runs daily → sets check_flag if timeout exceeded
- Agent reads check_flag → asks user if they're okay
- No reply → calls send_mail.py to notify emergency contact
Quick Start
1. Initialize
mkdir -p ~/.openclaw/apps/deadornot
2. Configure
Create config file ~/.openclaw/apps/deadornot/config:
[email protected]
MESSAGE=User is unresponsive, please check on them!
TIMEOUT_HOURS=24
ASK_HOUR=10
SMTP_SERVER=smtp.qq.com
SMTP_PORT=465
[email protected]
SMTP_PASSWORD=your_auth_code
3. Set up Cron
crontab -l | { cat; echo "0 0 * * * /path/to/check.sh >> /path/to/log.txt 2>&1"; } | crontab -
Configuration
| Variable | Default | Description |
|---|---|---|
| TIMEOUT_HOURS | 24 | Hours without message before check |
| NOTIFY_EMAIL | - | Emergency contact (required) |
| MESSAGE | "User is unresponsive!" | Email content |
| ASK_HOUR | 10 | When to ask (0-23) |
| SMTP_SERVER | smtp.qq.com | SMTP server |
| SMTP_PORT | 465 | SMTP port |
| SMTP_EMAIL | - | Sender email |
| SMTP_PASSWORD | - | SMTP auth code |
安全使用建议
Things to consider before installing:
- Metadata mismatch: the registry claims no required env vars, but the skill needs SMTP_EMAIL, SMTP_PASSWORD and NOTIFY_EMAIL. Treat that as a transparency red flag — ask the publisher why credentials were not declared.
- Credentials handling: the SKILL.md tells you to store SMTP_PASSWORD in ~/.openclaw/apps/deadornot/config in plaintext. If you proceed, create a dedicated sender account (not your primary email), use an app-specific password if available, and set strict file permissions (chmod 600) on the config directory and file.
- Cron and persistence: the instructions add a crontab entry (persistent). Review and approve the exact crontab line before installing; consider running the script manually for testing before scheduling it.
- Execution ambiguity: send_mail.py reads credentials from environment variables, while the config file is a shell file that check.sh 'source's. Ensure the agent or whatever calls send_mail.py also sources the config (or modify send_mail.py to read the config file directly) so credentials are not lost or accidentally exposed.
- Review network target: the default SMTP_SERVER is smtp.qq.com. Confirm that you trust the chosen SMTP provider and that credentials are appropriate for outbound email through that server.
- Trust and provenance: the skill has no homepage and an unknown owner id. If you do not trust the source, do not provide real credentials. Consider auditing or sandboxing the skill (run scripts in an isolated account/VM) before using it with real contact information.
- Safety checklist: confirm the skill only sends to NOTIFY_EMAIL (the code does so), test with a dummy recipient, restrict permissions on the config, and consider alternatives (e.g., using a secure mail relay or authenticated API rather than storing plaintext credentials).
If you want help: I can (1) produce a safer version of send_mail.py that reads a config file directly and avoids relying on shell-sourced env vars, (2) generate a safer cron setup example that includes logging and a dry-run mode, or (3) suggest safer authentication patterns (app-specific passwords or tokenized relay services).
功能分析
Type: OpenClaw Skill
Name: dead-or-not
Version: 1.0.2
The skill is classified as suspicious due to several critical vulnerabilities that could lead to arbitrary command execution and credential exposure. The `SKILL.md` instructs the agent to add a cron job using `crontab` with a placeholder `/path/to/check.sh`, which is a significant shell injection risk if the agent resolves this path insecurely. Additionally, the `scripts/check.sh` script uses `source "$CONFIG_FILE"`, allowing arbitrary command execution if the configuration file (`~/.openclaw/apps/deadornot/config`) is compromised. Finally, sensitive SMTP credentials are stored in plain text within this configuration file, posing a risk of exposure.
能力评估
Purpose & Capability
The skill's stated purpose (send an email alert when a user is unresponsive) legitimately requires an outbound email capability and credentials; the included scripts implement that. However, the registry metadata lists no required environment variables/credentials despite SKILL.md and the scripts requiring SMTP_EMAIL, SMTP_PASSWORD, and NOTIFY_EMAIL. That metadata mismatch is unexpected and reduces transparency about what secrets are needed.
Instruction Scope
SKILL.md instructs creating a config file in ~/.openclaw/apps/deadornot containing plaintext SMTP credentials and scheduling a cron job that runs the provided check.sh. The instructions are ambiguous about how the agent will invoke send_mail.py with the same environment (send_mail.py reads env vars while the config file is sourced by the shell script). The guide also instructs modifying the user's crontab — a persistent action — and gives no guidance to secure the config file (permissions) or to limit which SMTP server/account is used.
Install Mechanism
There is no external install script or network download; the skill is delivered as files (SKILL.md + two scripts). No third-party packages are fetched at install time. This is low risk from an install-mechanism perspective.
Credentials
The skill requires sensitive credentials (SMTP_EMAIL and SMTP_PASSWORD) and an emergency contact email; these are proportionate to sending email alerts but the registry does not declare them. Storing SMTP_PASSWORD in a plaintext config in the user's home directory is potentially unsafe. Also, send_mail.py expects credentials to be available as environment variables — SKILL.md relies on sourcing the config via shell but does not spell out how the agent will preserve/pass those variables when invoking the Python script.
Persistence & Privilege
The skill modifies user state persistently: it creates ~/.openclaw/apps/deadornot, writes config/last_seen/last_asked/check_flag files, and the guide directs adding a cron entry to the user's crontab. It does not request 'always: true' or system-wide privileges, and it does not modify other skills or system config beyond the user's crontab and files in the user's home directory.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install dead-or-not - 安装完成后，直接呼叫该 Skill 的名称或使用
/dead-or-not触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- Added scripts/check.sh and scripts/send_mail.py to the repository.
- Updated documentation in SKILL.md for simplified setup and configuration steps.
- Removed detailed setup instructions and code samples for send_mail.py from SKILL.md.
- Configuration table and Cron setup instructions are clarified for easier use.
v1.0.1
- Documentation rewritten to English for broader accessibility
- Descriptions and examples clarified and expanded for easier setup
- Configuration instructions refined and simplified
- Minor style and wording improvements throughout SKILL.md
- No code or functional changes in this update
v1.0.0
- Initial release of dead-or-not: a daily user presence checker and automated notification skill.
- Monitors user activity; if no messages are received in a set timeframe, prompts the user and, if unresponsive, sends an email alert to a designated contact.
- Fully configurable notification emails, timeouts, SMTP settings, and check times.
- Includes simple setup guides, a sending script (send_mail.py), and usage examples.
- Supports major SMTP providers (QQ, Gmail, etc.) via customizable configuration.
元数据
常见问题
Dead Or Not 是什么？
A "life check" skill that periodically checks if the user is still responsive. If the user hasn't messaged for a set time, it asks if they're okay, and if no... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 407 次。
如何安装 Dead Or Not？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install dead-or-not」即可一键安装，无需额外配置。
Dead Or Not 是免费的吗？
是的，Dead Or Not 完全免费（开源免费），可自由下载、安装和使用。
Dead Or Not 支持哪些平台？
Dead Or Not 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Dead Or Not？
由 Yuqiao Tan（@trae1oung）开发并维护，当前版本 v1.0.2。
推荐 Skills