OpenTIL

Capture and manage TIL (Today I Learned) entries on OpenTIL. Use /til <content> to capture, /til to extract insights from conversation, or /til list|publish|edit|search|delete|status|sync|tags|categories|batch to manage entries -- all without leaving the CLI.

What to check before installing: - Metadata mismatch: the registry entry claims no required env vars but SKILL.md uses a primaryEnv (OPENTIL_TOKEN). Expect to provide an OPENTIL_TOKEN environment variable or allow the skill to create/modify ~/.til/credentials. - Token scope: you will be asked to create a token with read:entries, write:entries, and delete:entries. Only grant scopes you are comfortable with (delete scope allows permanent deletes). - Local file writes: the skill will create and modify ~/.til/credentials and ~/.til/drafts/ and will migrate an old plaintext token into YAML automatically. Back up any existing ~/.til files if you care about them. - OAuth flow: the auth command opens your browser (open/xdg-open) and runs a polling loop to obtain a token — this requires the agent to run shell commands that interact with the system browser. - Proactive suggestions: the auto-detection doc instructs the agent to append TIL suggestions to normal responses. If you don’t want unsolicited suggestions appended to agent outputs, avoid enabling that feature or confirm how/when it runs. If you proceed: create a dedicated token with the minimum necessary scopes, inspect ~/.til after first run, and consider setting OPENTIL_TOKEN in your environment rather than relying on profile migration if you want explicit control. If you need higher assurance, ask the publisher to fix the registry metadata to declare OPENTIL_TOKEN so required permissions are transparent.

Type: OpenClaw Skill Name: til Version: 1.11.0 The OpenClaw AgentSkills skill bundle for OpenTIL is classified as benign. It performs expected operations for a 'Today I Learned' management tool, including extensive API calls to `https://opentil.ai`, reading/writing sensitive API tokens to `~/.til/credentials`, and managing local drafts in `~/.til/drafts/`. While these capabilities are high-risk, the skill explicitly implements strong security measures like `chmod 600` for the credentials file and guides users on secure token management. A prompt injection instruction ('DO NOT read reference files unless specified below') is present in `SKILL.md`, but its intent is to control the agent's internal context rather than to induce malicious behavior, making it a benign control mechanism.