Sleepwell

Track sleep habits and analyze rest patterns over time. Use when logging bedtimes, planning schedules, tracking streaks, reviewing weekly patterns.

This skill appears to be a straightforward, local sleep-logging tool. Before installing, note three practical items: (1) the scripts call python3 but SKILL.md doesn't list Python as a dependency — ensure python3 is available; (2) there are two data locations used (~/.local/share/sleepwell and ~/.sleep) which may lead to split data — decide which you want and (optionally) set SLEEP_DIR to control where the diary stores data; (3) all data and exports are stored on disk in plain files under your home directory (not encrypted or remote), so avoid logging sensitive personal info or regularly back up / secure the directory. Review the two included scripts if you want to confirm behavior, and remove the data directories if you uninstall the skill.

Type: OpenClaw Skill Name: sleepwell Version: 2.0.1 The skill bundle contains a critical command injection vulnerability in `scripts/sleep_diary.sh`. User-supplied arguments for sleep hours and quality are directly interpolated into a Python heredoc without sanitization, which allows for arbitrary code execution. While the stated purpose of sleep and productivity tracking is benign and no evidence of intentional malice, data exfiltration, or backdoors was found, the high-risk nature of this vulnerability warrants a suspicious classification.