Timemap

PassAudited by ClawScan on May 1, 2026.

Overview

Timemap appears to be a purpose-aligned, read-only wrapper for public venue-history data, with only expected local Python execution, public API access, and a small local cache.

This looks safe for its stated purpose: it searches public Timemap venue data. Before installing, be aware that it runs a local Python script, contacts timemap.co.il, and keeps a short-lived cache of public data in the temp directory.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI05: Unexpected Code Execution

What this means

Using the skill lets the agent run the included Python script to answer Timemap-related questions.

Why it was flagged

The skill is operated by running an included Python CLI script. This is local code execution, but it is clearly disclosed and central to the skill's stated purpose.

Skill content

python3 {baseDir}/scripts/timemap.py search "רוטשילד"

Recommendation

Only install if you are comfortable with the agent running this local Python script; the visible instructions keep execution scoped to Timemap search commands.

Note

ASI02: Tool Misuse and Exploitation

What this means

The skill may contact timemap.co.il and create a temporary local cache of public venue data.

Why it was flagged

The script fetches data from a fixed public API endpoint and caches it locally. This network and file behavior is disclosed in the README and fits the read-only search purpose.

Skill content

API_URL = "https://timemap.co.il/api/venue" ... CACHE_FILE = os.path.join(tempfile.gettempdir(), "timemap-venues-cache.json")

Recommendation

Use it for public Timemap queries; avoid assuming the community-curated data is complete or authoritative.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing through npx relies on external tooling and package resolution outside the skill's own files.

Why it was flagged

The README recommends an npx-based installation path. This is a normal, user-directed install method, but it depends on external package/install tooling.

Skill content

npx skills add alexpolonsky/agent-skill-timemap

Recommendation

Install from the expected GitHub or registry source and review the package/source if provenance matters to you.