Productivity Bot
PassAudited by ClawScan on May 10, 2026.
Overview
This is a vague instruction-only productivity automation skill with no code, but it openly mentions scheduling, notifications, webhooks, and API keys, with no evidence of hidden or harmful behavior.
This skill appears benign as provided, but it is only a description and example. Before using it, verify any external Python package or helper code, provide only narrow API keys, and carefully review what data scheduled jobs or webhooks will send.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill itself does not execute code, but using an external productivity_bot package would require trusting code that was not reviewed here.
The usage example depends on a Python module, but the supplied artifacts contain no code files and no install spec. This is a provenance gap if a user later installs an external package to make the example work.
from productivity_bot import Scheduler, DataProcessor
Only install a productivity_bot package or helper code after verifying its source, contents, and integrity.
If configured with broad API keys, the automation could act on connected email, messaging, or webhook accounts beyond what the user intended.
The skill says API keys may be needed, but it does not identify providers, scopes, or storage expectations. This is common for integrations, but users should avoid broad credentials.
## Requirements - Python 3.8+ - Various API keys
Use least-privilege, service-specific API keys and do not provide unrelated credentials.
Reports or reminders could leave the local environment and be sent to third-party services or webhook URLs.
The skill describes sending information to external messaging systems and custom webhook endpoints. This is purpose-aligned for notifications, but destination and data boundaries are not defined.
- Email alerts - Slack/Discord messages - Custom webhooks
Review each destination before use and avoid sending sensitive files, credentials, or private data unless the endpoint is trusted.
If implemented, scheduled jobs could continue sending reports or syncing data until disabled.
The skill describes scheduled recurring tasks. This is central to the stated productivity purpose, and no hidden persistence mechanism is included in the artifacts.
- Daily reminders
- Periodic data syncs
scheduler.every day.at("9:00").do(send_report)Use clear schedules, keep a list of enabled jobs, and make sure recurring tasks can be reviewed and stopped.