获取 Flomo 指定月份的完整笔记并评估质量。当用户说"查看flomo XX年XX月的全部笔记"、"获取flomo某月笔记"、"拉取flomo历史记录"或"评估flomo笔记质量"时触发使用。支持智能三级降级策略（周→天）确保完整覆盖，内置质量评估规则自动标记低质量笔记。

This skill largely does what it says, but be aware it will run the 'mcporter' CLI using a config file at ~/.openclaw/workspace/config/mcporter.json (the code assumes that path). The registry metadata did not declare that config path or any credentials, so installing or running the skill will cause the agent to use whatever MCP credentials are stored there. Before installing or allowing autonomous runs: (1) verify you trust the skill source; (2) inspect the included scripts yourself (they are small); (3) ensure mcporter is configured with an account you are comfortable the skill using (consider a limited/test account); (4) avoid running it with elevated or multi-service credentials stored in mcporter; (5) consider running the scripts manually rather than granting the agent autonomous invocation if you are unsure. If you need full assurance, ask the author to declare required config paths/credentials in the manifest and to avoid hard-coded config locations or use a configurable path/explicit credential environment variables.

Type: OpenClaw Skill Name: flomo-archive Version: 1.0.0 The skill contains a shell injection vulnerability in `scripts/fetch_month.py` where `subprocess.run(shell=True)` is used with string concatenation to execute the `mcporter` CLI tool. While the script currently constrains inputs (year and month) to integers, the pattern of building shell commands from variable arguments is high-risk. Additionally, the script explicitly accesses the OpenClaw workspace configuration file at `~/.openclaw/workspace/config/mcporter.json` to facilitate API calls.