v1.0.1

Touch The Grass

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:57 AM.

Analysis

This wellness skill is coherent and disclosed, but it can set daily reminders, create Google Calendar events, and store personal progress/mood data.

GuidanceThis skill appears benign and aligned with its wellness purpose. Before installing, make sure you want daily proactive reminders, Google Calendar event creation, and memory storage for your activity streak, score, and mood check-ins.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Rogue Agents

SeverityLowConfidenceHighStatusNote

README.md

openclaw cron add \
  --name "touch-the-grass-daily" \
  --cron "0 9 * * *"

The documented setup creates a persistent daily OpenClaw cron reminder. It is disclosed and tied to the skill’s purpose, but it means the skill can prompt the user proactively.

User impactYou may receive daily morning reminders after configuring the cron or heartbeat option.

RecommendationInstall the daily cron only if you want proactive reminders, and remove or disable it if the reminders become unwanted.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

README.md

- **Agenda en Google Calendar** — crea eventos con recordatorios para que no se te olvide tocar el pasto

The skill is expected to use a user’s Google Calendar integration to create events. This is purpose-aligned and user-directed, but it is still third-party account mutation.

User impactThe skill may add events and reminders to your calendar when you choose activities to schedule.

RecommendationOnly enable the Google Calendar integration if you are comfortable with the skill creating wellness-related calendar events, and review proposed event details before confirming.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

El estado del usuario (score, streak, actividades completadas) se guarda en la **memoria del agente**

The skill persists personal progress and mood/activity information in agent memory for later scoring and reminders. This is disclosed and relevant to the feature, but it is personal wellbeing data.

User impactYour activity history, streak, score, and mood check-ins may be reused in later conversations or reminders.

RecommendationAvoid sharing sensitive photos or details you do not want remembered, and ask the agent to show, correct, or delete the stored Touch the Grass state if needed.