Morning Briefing Litiao

Automation skill for Morning Briefing Litiao.

This skill's goal (morning briefing from Reminders + Notion) is plausible, but the shipped script reads a Notion API key from ~/.config/notion/api_key and calls remindctl, curl, and jq even though none of these are declared in the skill metadata. Before installing: (1) verify the skill source/trustworthiness; (2) inspect the script yourself (it is included) and confirm you are comfortable with it reading ~/.config/notion/api_key — move or protect that file if needed; (3) ensure required binaries (remindctl, curl, jq) are present and sandbox the skill if possible; (4) prefer a version that uses an explicitly-declared environment variable for the Notion token (or add that config path/env to the skill manifest) so the behavior is documented; (5) if you do not want a skill to read local secrets, do not install or run it until it’s modified to accept credentials safely. If you want, I can suggest specific manifest changes or a safer script variant that reads the token from an env var instead of a local file.

Type: OpenClaw Skill Name: morning-briefing-litiao Version: 1.0.0 The skill bundle provides a legitimate utility for generating morning reports by aggregating data from Apple Reminders and the Notion API. The shell script (scripts/generate-briefing.sh) reads a local configuration file (~/.config/notion/api_key) to authenticate with Notion, which is consistent with its stated purpose. No evidence of data exfiltration, malicious execution, or prompt injection was found.