Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
iCalendar Events Parser
v1.0.2Parse .ics / iCalendar files or URLs, expand recurring events (RRULE), filter by date range / keywords, and return clean list of events. Use this instead of...
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description align with the code and package.json: it parses local .ics files or remote .ics URLs, expands recurrences and filters events. Required binary is only node, and the declared JS dependencies (icalendar-events, luxon) are coherent with the functionality.
Instruction Scope
SKILL.md and index.js limit filesystem reads to the agent workspace and the skill folder, and network access is used only to fetch the provided .ics URL. The instructions ask you to run 'npm install' and chmod the entry file (expected for a Node CLI). Note: SKILL.md tells agents not to use the built-in web_fetch and to call this tool instead — that is consistent but gives the skill responsibility for remote fetches.
Install Mechanism
There is no automated install spec; installation is manual (npm install). That means dependencies will be pulled from the public npm registry when you run npm install. The packages listed in package-lock.json resolve to npmjs.org (expected for this purpose). This is typical for Node-based skills but worth awareness because npm install will run network I/O and write code to disk.
Credentials
The skill does not require secrets and doesn't declare required env vars, but the code reads optional environment variables (OPENCLAW_HOME, OPENCLAW_WORKSPACE, OPENCLAW_PROFILE, NODE_ENV). Those are reasonable for locating the workspace but are not listed among declared env requirements — this mismatch should be noted. Also the skill requests broad outbound network access ('*') which is justified for fetching arbitrary .ics URLs but is permissive.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request elevated or persistent platform privileges beyond normal exec/filesystem/network access.
Assessment
This skill appears to do what it claims: it fetches .ics URLs or reads .ics files from your OpenClaw workspace and expands/filter events. Before installing: (1) inspect the included index.js (done here) and confirm you're comfortable with its workspace-only file access rules; (2) run npm install in a controlled environment — npm packages will be downloaded from the public registry; (3) be aware the tool will fetch any URL you pass it (network access is broad), so don't feed it private endpoints or credentials; (4) note the code reads OPENCLAW_HOME/OPENCLAW_WORKSPACE/OPENCLAW_PROFILE if present (these env vars are optional but used), and they were not declared in requires.env — consider whether you want those set in your agent environment. If you need higher assurance, run the tool in an isolated sandbox or inspect/lock the installed node_modules before use.index.js:28
Environment variable access combined with network send.
index.js:5
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk972tkaz5hb76xrj7ynqvw5f7s84254y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsnode