Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Calendar Manager
v1.0.0Manage calendar availability, schedule meetings across timezones, find optimal meeting times, and send calendar invites. Use when user wants to (1) find avai...
⭐ 0· 15·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and the SKILL.md all focus on availability, timezone conversion, and .ics generation; the requested capabilities align with the stated purpose and no unrelated services or credentials are requested.
Instruction Scope
Instructions mention 'parse calendar files or ask user' but do not specify what files/locations or what APIs to use. That ambiguity means the agent might (a) ask the user to paste calendar data, (b) request access to external calendar APIs, or (c) attempt to read local files — the SKILL.md does not constrain those behaviors.
Install Mechanism
This is an instruction-only skill with no install spec, no code files, and no downloads — lowest-risk delivery mechanism. It only suggests using pytz/zoneinfo for timezone work, which is reasonable for implementation but not enforced.
Credentials
No environment variables, credentials, or config paths are declared. However, the workflow promises to 'send invites' which normally requires SMTP or calendar API credentials (OAuth tokens, API keys). The absence of any declared credential mechanism is a mismatch that should be clarified.
Persistence & Privilege
Skill does not request always:true, does not declare any persistent config changes, and makes no claim to modify other skills or system-wide settings.
What to consider before installing
Before installing or using this skill, clarify exactly how it will obtain calendar data and how it will send invites. Questions to ask the provider: (1) Will the agent prompt you to paste .ics/events, or does it connect to Google/Outlook APIs? (2) If it connects to external calendars, what OAuth scopes are required and how are tokens stored? (3) How are invites sent (SMTP vs calendar API) and what credentials are needed? Avoid pasting sensitive calendar exports into chat; do not hand over full account passwords — prefer limited-scope OAuth tokens or a test calendar. If you plan to let the agent access live calendars, require explicit, auditable consent and inspect any future install spec or code that requests network access or credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk970tgjyjdzawd14r72vyyjs9d84d9bb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.