← 返回 Skills 市场

Luma Event Manager

Name: Luma Event Manager
Author: mariovallereyes

作者 mariovallereyes · GitHub ↗ · v2.1.1

cross-platform ⚠ suspicious

2119

总下载

当前安装

版本数

在 OpenClaw 中安装

/install luma-event-manager

功能描述

Luma Event Manager for Clawdbot — Discover events by topic or location, RSVP, view guest lists, and sync to Google Calendar. No API key required (web scraping), no Luma Plus subscription needed.

使用说明 (SKILL.md)

Luma Event Manager

Manage Luma events as both host and attendee via web scraping (no API key required).

Features

Public (No Auth)

Discover events near any location
View event details
Geographic filtering

Authenticated (With Cookies)

View your RSVP'd events
View events you're hosting
Access guest lists
RSVP to events
Sync events to Google Calendar (via gog CLI)

Triggers

Discover Events (Public)

"luma search AI" — Find events by topic/theme
"luma search startup near San Francisco" — Topic + location
"luma events near San Francisco"
"luma events near Belmont this weekend"
"luma event ai-meetup-sf"

Host Mode (Auth Required)

"luma host events" — List your hosted events
"luma host guests \x3Cslug>" — View guest list

Attendee Mode (Auth Required)

"luma my events" — Your RSVP'd events
"luma rsvp \x3Cslug> \x3Cresponse>" — RSVP yes/no/maybe/waitlist

Utility

"luma configure" — Set up authentication
"luma status" — Check connection
"luma help" — Show help
"luma add calendar \x3Cslug>" — Add event to Google Calendar

Setup

Basic (Public Events Only)

No setup required. Just use discover commands.

Full Access (Your Events + Guest Lists)

Log into lu.ma in your browser
Open DevTools (F12) → Application → Cookies → lu.ma
Copy cookie values: luma_session, luma_user_id
Store in pass:

pass insert luma/cookies
# Enter: {"luma_session": "value", "luma_user_id": "value"}

Calendar Sync (Optional)

Requires the gog CLI with an authorized Google account.

gog auth add [email protected]

Then:

"luma add calendar \x3Cslug>"
"luma add calendar \x3Cslug> --account [email protected]"
"luma add calendar \x3Cslug> --calendar_id primary"

Examples

"Events near me this weekend"
"What's the AI meetup about?"
"luma event startup-pitch-night"
"Show my upcoming events"

Notes

Uses web scraping (no paid Luma Plus required)
Exponential backoff with a 1 req/sec floor to respect lu.ma
Fallback selectors + Next.js JSON parsing with warnings when selectors fail
Cookie auth for private data
Public events always accessible

安全使用建议

Things to consider before installing: - Confirm the author/repo (SKILL.md points to a GitHub repo) and review the source code (especially src/scraper.ts, src/rsvp.ts, and package.json) for any network endpoints other than lu.ma and Google. - Understand that using this skill for authenticated actions requires you to supply lu.ma session cookies; the SKILL.md recommends storing them in pass. Only do this if you trust the code, and prefer temporary credentials or manual, per-use entry if possible. - Inspect package.json and dependencies before running npm install to ensure no malicious packages will be installed. - Consider disabling model-initiated invocation of the skill (disableModelInvocation=true) or requiring explicit user prompts before any authenticated action (RSVP, viewing guest lists, syncing calendars). - Verify that the skill only communicates with lu.ma and Google endpoints; if you find hard-coded external URLs in the code, do not install. - If you are uncomfortable storing session cookies in pass, refuse providing them and use the skill only in public/discovery mode. If you want, I can fetch and summarize the package.json and key source files to point out any suspicious network calls or uncommon dependencies.

功能分析

Type: OpenClaw Skill Name: luma-event-manager Version: 2.1.1 The skill is classified as suspicious due to its use of `child_process.execFile` to execute external binaries, specifically `pass` and `gog`. While these actions are explicitly documented in `SKILL.md` and `README.md` and appear to be for the stated purpose (retrieving Luma session cookies from `pass` and syncing events to Google Calendar via `gog`), the capability to execute arbitrary commands via `child_process` is inherently high-risk. The `scraper.ts` file executes `pass show luma/cookies` to retrieve user credentials, and `calendar.ts` executes `gog` commands for calendar integration, both representing sensitive operations involving external system tools.

能力评估

⚠ Purpose & Capability

The SKILL.md and code files implement web scraping, RSVP, and Google Calendar sync (via the gog CLI) which matches the description. However the registry metadata earlier reported no required binaries or homepage while SKILL.md metadata requires the 'pass' binary and references the 'gog' CLI — those binaries are reasonable for the stated features but their omission from the registry is an inconsistency that reduces trust.

⚠ Instruction Scope

Runtime instructions ask the user to export lu.ma session cookies and store them in pass. That gives the skill access to authenticated user sessions (host/guest lists, RSVP). The SKILL.md does not instruct reading any unrelated system files, but the explicit request to store session cookies in pass is a sensitive operation and could be abused if the skill reads them automatically.

ℹ Install Mechanism

There is no registry install spec, but SKILL.md includes an npm install step and the package.json + package-lock.json are present — installing will fetch npm dependencies (moderate risk). No remote binary download or obscure URL is used in the provided instructions, which reduces install risk, but you should inspect package.json dependencies before running npm install.

⚠ Credentials

The skill requires sensitive credentials in practice (lu.ma session cookies) and relies on local CLIs ('pass' to store/read cookies, and optionally 'gog' for Google Calendar). The registry metadata lists no required env vars/binaries while SKILL.md requires 'pass' and references 'gog' — this mismatch is troubling because it understates the level of access needed to operate and to be useful.

⚠ Persistence & Privilege

The skill is not marked always:true, but disable-model-invocation is not set; that means the model could invoke the skill autonomously. Because the skill accesses session cookies via pass and can perform authenticated actions (view guest lists, RSVP), allowing autonomous invocation without additional safeguards increases the risk of unintended account access.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install luma-event-manager
安装完成后，直接呼叫该 Skill 的名称或使用 /luma-event-manager 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v2.1.1

Added repo link to description

v2.1.0

Topic search, location filtering, RSVP, calendar sync. No API key required.

元数据

Slug luma-event-manager

版本 2.1.1

许可证 —

累计安装 1

当前安装数 1

历史版本数 2

常见问题