个人日程管理

个人日程管理 Skill - 自然语言设置、自动提醒、重复日程、Web界面、导入导出

This package largely does what it says: a local scheduler with NL input, a web UI, and local reminders. Before installing or running it: 1) Inspect and edit data/config.json to remove or replace the default feishu_user_id (do not leave the bundled ID); 2) Search the skill data folder after running for reminder_jobs.json / cron_jobs.json and confirm no unexpected recipient IDs or commands are stored; 3) Be aware that reminders are delivered by the platform capturing printed output — verify OpenClaw's delivery behavior in a safe test (use a test account or disable sending) so private reminders are not forwarded to third parties; 4) Note the code inconsistency: check_reminders.py expects a 'reminders' DB table that is never created — reminders may be managed via JSON files instead; test reminder flows end-to-end to ensure behavior matches your expectations; 5) Run the skill locally in a sandboxed environment if possible and audit the files it writes (data/*.json, scheduler.db) before trusting it with sensitive calendar data.

Type: OpenClaw Skill Name: personal-scheduler Version: 1.0.0 The skill bundle contains a critical security vulnerability in `scripts/web_server.py`, where the Flask web server is configured to run in debug mode on all network interfaces (`0.0.0.0:8080`), which allows for Remote Code Execution (RCE) via the interactive debugger. Additionally, a specific Feishu user ID (`ou_669575f70b8b81dd5c431c4ed1ad41c4`) is hardcoded as a default in `scripts/scheduler.py` and `scripts/cron_manager.py`, which could lead to the unauthorized exfiltration of calendar event details to an external party if the user fails to update the configuration file as instructed in `SKILL.md`.