Readwise & Reader

Access Readwise highlights and Reader saved articles

This skill appears to do only what it claims: interact with Readwise/Reader using your READWISE_TOKEN and Node. Before installing: (1) confirm you trust the skill source/owner; (2) only provide a Readwise API token (do not reuse more privileged credentials); (3) avoid storing the token in world-readable/shared files — if you put it in ~/.clawdbot/clawdbot.json, ensure correct file permissions; (4) verify you have a Node version with global fetch (Node 18+), or run the scripts in an environment you control; (5) if you want extra assurance, inspect the two included .mjs files locally — they only contact readwise.io and output JSON. If any registry metadata is shown to require no env vars, prefer the SKILL.md and code as the source of truth and proceed accordingly.

Type: OpenClaw Skill Name: readwise Version: 1.0.0 The skill bundle provides legitimate client scripts for interacting with the Readwise and Readwise Reader APIs. It correctly retrieves the `READWISE_TOKEN` from environment variables for authentication and makes all network requests to the official `readwise.io` domain. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. The `SKILL.md` provides clear, functional instructions for using the skill without any harmful directives.