cn-time-parser

AdvisoryAudited by Static analysis on May 8, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the skill will fetch and install npm dependencies needed for lunar calendar and holiday calculations.

Why it was flagged

The skill depends on third-party npm packages and asks the user to install them before use. This matches the time-parsing purpose, but it introduces normal package supply-chain considerations.

Skill content
需要安装Node.js环境,以及dayjs、lunisolar和chinese-workday模块
- 准备命令:在使用前执行 `cd /workspace/projects/cn-time-parser && npm install`
Recommendation

Install only from a trusted skill source, keep the included package-lock.json, and avoid running npm install if the package files differ from the reviewed artifacts.

What this means

The local script will process the query text you provide and return parsed date, timestamp, lunar, holiday, and workday information.

Why it was flagged

The skill works by running a local Node.js script with the user's query. This is expected for the stated functionality and the visible code is focused on date parsing.

Skill content
脚本调用示例:`node scripts/parse-time.js --query "今天的天气怎么样"`
Recommendation

Run the script only from the skill directory and pass only the text needed for time parsing.