Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
scheduler for discord
v1.0.0Create and manage scheduled reminders and posts. Use when the user asks Moltbot to send a message later or on a recurring schedule (especially to the current Discord channel) without requiring them to provide channel IDs.
⭐ 0· 1.8k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (schedule Discord messages) is reasonable, but the runtime instructions rely on a 'moltbot' CLI and access to Discord channel identifiers/config (metadata shows moltbot.requires.config: ["channels.discord"]). The published registry metadata lists no required binaries or config paths. The skill should have declared 'moltbot' as a required binary and the channels.discord config; the absence is an incoherence.
Instruction Scope
The SKILL.md stays within the scheduler remit (collect time, timezone, message, target) and explicitly instructs capturing channel IDs at creation time. That behavior is coherent for reliable delivery, but it does mean channel IDs (and scheduled message text) will be stored in cron jobs — a privacy/retention consideration the user should understand.
Install Mechanism
This is instruction-only (no install spec), which is low-risk in itself, but the instructions call out to an external binary via exec ('moltbot cron add'). Because the skill does not declare that dependency, the agent could fail at runtime or invoke an unexpected binary if present. The skill should explicitly declare required binaries and where they come from.
Credentials
The registry claims no required env vars or config paths, yet SKILL.md/metadata expect Discord channel context and a config key channels.discord. This mismatch is concerning: the skill implicitly requires access to messaging context/config that wasn't declared, and that should be made explicit. No secrets are requested, which is appropriate.
Persistence & Privilege
The skill creates scheduled, autonomous agent jobs (cron entries) that will run later and deliver messages. This is expected for a scheduler, but it increases blast radius because scheduled jobs can invoke the agent in the future. The skill does not request always:true, but users should review what the scheduled job will do and what data (channel IDs, message text) it will persist.
What to consider before installing
This skill appears to implement a reasonable scheduler, but it currently omits important declarations. Before installing: 1) Ask the author to declare required binaries (moltbot CLI) and required config (channels.discord) so you know what will be called and what will be read. 2) Verify the source and integrity of the moltbot CLI on your system (who provides it, where it's installed). 3) Understand that scheduled jobs will store channel IDs and message text and will run agent jobs later — review and approve what those jobs will execute. 4) Prefer a skill that explicitly documents dependencies and permissions (binaries, config paths, and where cron jobs are created). If you cannot verify those details, treat this skill cautiously or avoid installing it.Like a lobster shell, security has layers — review code before you run it.
latestvk970cnawaf4fnfnxm6dgqh6vp180c6t8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.