standard-book-learning

协调管理书籍学习流程，按顺序调用章节提取、笔记生成、图谱构建及导入模块，跟踪进度并生成总结报告。

What to consider before installing or running this skill: - Inspect and edit scripts before running: the neo4j importer docs include a plaintext password; search all files (including .py and .md) for any hardcoded credentials and remove them. Replace with environment variables or a secure config file. - Provide credentials securely: the skill does not declare required env vars. If you use Neo4j, configure the connection (URI, username, password) via environment variables or a secure secret store, not by editing scripts with plaintext secrets. - Run in a safe environment first: test in an isolated VM or container and point the importer at a disposable/local Neo4j instance. That avoids accidental import into production databases or exposing real data. - Be aware of filesystem access: the workflow reads from F:\book and writes to F:\Obsidian. Ensure the paths are correct and that sensitive files are not unintentionally processed. Adjust paths in code if you use a different OS or directory layout. - Install dependencies explicitly: before running, pip-install required packages (python-docx, PyPDF2, etc.). The package does not declare an install step. - If you want this skill to run autonomously, consider limiting its permissions and confirm database and file access policies. If anything looks unexpected (other hardcoded endpoints, outbound network calls, or requests for unrelated credentials), do not run the skill and ask the author for clarification. If you want, I can: (1) scan the included Python scripts for any other hardcoded secrets or external endpoints, (2) suggest specific edits to move credentials to env vars, or (3) produce a checklist to safely run this skill in a VM.

Type: OpenClaw Skill Name: reading-book Version: 1.0.0 The 'reading-book' skill bundle coordinates a workflow for extracting book chapters, generating Obsidian notes, and importing knowledge into a Neo4j database. The primary security concern is the presence of hardcoded credentials ('12358lpok') for the Neo4j database found in 'neo4j-importer-script.py' and 'neo4j-importer.md'. While the bundle's file system access and local network calls (targeting localhost:7474) are consistent with its stated purpose, the inclusion of hardcoded passwords is a significant security vulnerability. No evidence of intentional malice, data exfiltration, or prompt injection was found.