Wilma Triage
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only skill is coherent with its stated school-notification triage purpose, but it uses sensitive Wilma and Google Calendar access and stores some preferences persistently.
Before installing, make sure you trust the separate `wilma` and `gog` tools, choose a dedicated Google calendar if possible, and review what the agent stores in MEMORY.md and TOOLS.md. The provided artifacts do not show hidden code, exfiltration, or behavior outside the stated Wilma triage and calendar-sync workflow.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may access private school records and the selected Google Calendar through existing local credentials.
The skill openly requires local school-system credentials and Google OAuth access. That is expected for Wilma triage and calendar sync, but it gives the agent access to sensitive accounts.
Requires local Wilma credentials (~/.config/wilmai/config.json) for school data access and gog CLI auth (Google OAuth) for calendar sync.
Use only trusted `wilma` and `gog` setups, confirm which Google calendar is selected, and avoid installing this on shared or untrusted machines.
Incorrect matching or configuration could create unwanted calendar events or remove events that look cancelled.
The skill can mutate Google Calendar data by adding and removing school events. This is aligned with the stated purpose, and the skill includes a no-duplicates rule, but it is still account modification authority.
Calendar sync — add missing exams and actionable events using gog CLI commands from TOOLS.md ... Remove cancelled events from calendar
Review the chosen calendar and naming rules during setup, and consider asking the agent to summarize planned calendar changes before applying them.
Future agent sessions may reuse stored school-triage preferences and potentially reveal family or student context if memory is shared or reviewed.
The skill intentionally persists calendar configuration and family-specific triage preferences. This supports the workflow, but persistent memory can retain sensitive context about children, schools, and parental preferences.
Store the calendar ID in TOOLS.md ... Store in MEMORY.md as part of the Wilma triage context. Over time, the user will give feedback ... store these preferences in MEMORY.md.
Keep stored preferences minimal, avoid saving full message contents unless needed, and periodically review or delete the Wilma Triage section in MEMORY.md and TOOLS.md.
The safety of actual Wilma and Google Calendar operations depends on the separately installed `wilma` and `gog` tools.
This instruction-only skill delegates important credential and calendar operations to external skills/binaries. Those dependencies are disclosed, but their code is not part of the provided artifact review.
wilma skill — install from ClawHub (`clawhub install wilma`) ... gog skill — install from ClawHub (`clawhub install gog`)
Review and install only trusted versions of the `wilma` and `gog` dependencies before using this triage skill.