Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Scrask
v1.0.1When the user sends a screenshot via Telegram, parse it using Gemini (fast, default) with automatic Claude fallback when confidence is low. Saves results to...
⭐ 0· 585·0 current·0 all-time
bySandip Dev@devsandip
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The declared purpose (parse screenshots and save to Google Calendar/Tasks) matches the code and required env vars (GEMINI_API_KEY, GOOGLE_CREDENTIALS). ANTHROPIC_API_KEY is optional for Claude fallback, which is coherent. Minor packaging/documentation mismatches: SKILL.md/README refer to scripts/ paths while the manifest lists scrask_bot.py at top level, and SKILL.md's version (3.0.0) differs from registry version (1.0.1) — these are sloppy but not indicative of malicious intent.
Instruction Scope
Runtime instructions are scoped to parsing screenshots, saving to Google Calendar/Tasks, and asking for confirmation on low-confidence items. One behavioral note: the agent is instructed to send the script's 'telegram_reply' back verbatim and the Gemini client safety settings are relaxed to avoid blocking content — this increases reliance on model output and could surface unexpected text/links directly to the user if the model hallucinates.
Install Mechanism
No automatic installer is provided (no download URL); dependencies are typical PyPI packages listed in requirements.txt (anthropic, google-generativeai, google-api-python-client, etc.). This is proportionate to the stated functionality and avoids arbitrary remote downloads.
Credentials
Requested environment variables (GEMINI_API_KEY and GOOGLE_CREDENTIALS) are appropriate and proportional. The Google service account JSON grants Calendar/Tasks write scopes — users should understand this gives the skill permission to create/modify events and tasks. ANTHROPIC_API_KEY is optional for fallback; no unrelated secrets are requested.
Persistence & Privilege
The skill is not force‑enabled (always:false) and does not request elevated platform privileges. It does require credentials that allow writing to the user's Google calendar/tasks, which is expected behavior for its purpose.
Assessment
This skill appears to do what it says: it sends screenshots to Gemini (and optionally Anthropic/Claude) for parsing and then writes events/reminders/tasks into Google Calendar/Tasks using a service account. Before installing: (1) Be comfortable with images and extracted text being sent to third‑party LLM providers (Gemini/Anthropic). (2) Create a least‑privileged Google service account, grant only the Calendar/Tasks scopes needed, and review which calendar is shared with the service account. (3) Verify the GEMINI_API_KEY and optional ANTHROPIC_API_KEY you provide are scoped/managed according to your policy. (4) Inspect the included scrask_bot.py locally (you have the source) to confirm there are no hidden network calls or logging of secrets beyond what you expect (the provided code appears to call only the model SDKs and Google APIs). (5) Note minor packaging/documentation inconsistencies (file paths and version number) — consider testing in a sandbox before enabling on a primary account.Like a lobster shell, security has layers — review code before you run it.
latestvk970jr4ecvj8s2bm081wsns1y581dmkk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis
Binspython3
EnvGOOGLE_CREDENTIALS, GEMINI_API_KEY
Primary envGEMINI_API_KEY