Jwdiario
PassAudited by ClawScan on May 10, 2026.
Overview
The skill appears to do what it says—fetch the Spanish JW daily text—but it includes a small script that uses a local shell call to curl instead of the documented web_fetch approach.
This looks safe for its stated purpose, but be aware that the included script uses a local shell command to run curl even though the skill description says it uses web_fetch. Install it only if you are comfortable with it fetching content from wol.jw.org, and consider asking the author to replace or clearly declare the curl-based implementation.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If this script is run, it will execute the local curl command to contact wol.jw.org for the current day’s page.
The included script invokes a shell command to fetch the page. The target URL is generated by the script for wol.jw.org/es and is not user-controlled, so this appears purpose-aligned, but it is a shell execution path users should be aware of.
const html = execSync(`curl -s "${url}"`, { encoding: 'utf-8' });Prefer the documented web_fetch or a native HTTP library, or explicitly declare the curl dependency and shell behavior so users understand how the fetch is performed.