Manage Joplin notes via REST API. Use for creating, reading, updating, deleting, or searching Joplin notes programmatically.

This skill appears to do what it says: it is a local Joplin Data API client implemented in Python and requires a JOPLIN_TOKEN (API token) and python3 with requests and python-dotenv. Before installing, check: 1) Provide a valid JOPLIN_TOKEN and confirm whether your runtime environment will supply the SKILL.md pip install step (the registry metadata omitted required env info). 2) Review and, if needed, change JOPLIN_IMPORT_DIR/JOPLIN_EXPORT_DIR to a directory you control — the default is /root/.openclaw/workspace and the code blocks access to /home and other system dirs which may prevent using your normal home directory. 3) Confirm you trust the code bundle (it calls only your configured Joplin server URL and does not phone home); if you plan to point JOPLIN_BASE_URL at a remote host, ensure the host is trusted. Finally, if you need the skill to run on a non-root environment, adjust the default workspace paths accordingly.

Type: OpenClaw Skill Name: joplin-api Version: 0.1.3 The OpenClaw AgentSkills bundle for Joplin API is classified as benign. The skill's primary function is to manage Joplin notes via its REST API, which it accomplishes using standard Python libraries like `requests` and `argparse`. Crucially, the `joplin_export.py` and `joplin_import.py` scripts implement robust path sanitization using `pathlib.Path.resolve()`, explicitly defining `ALLOWED_BASE_DIRS` (e.g., `/root/.openclaw/workspace`) and a comprehensive list of `BLOCKED_DIRS` (e.g., `/etc`, `/home`, `/bin`), effectively mitigating path traversal vulnerabilities. There is no evidence of malicious intent, data exfiltration, unauthorized execution, or prompt injection attempts in any of the files, including the `SKILL.md` instructions.