Time Anchor

PassAudited by ClawScan on May 6, 2026.

Overview

Time Anchor is a straightforward date-math helper that runs a local Python script, with no evidence of data theft, credential access, or destructive behavior.

This skill appears safe for ordinary date math. Be aware that it runs a local Python script, may web-search unknown public event names, and can store custom goals if you edit the TARGETS dictionary.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run a bundled local script when answering date questions, but the reviewed script only performs date calculations and prints results.

Why it was flagged

The skill's normal operation involves local Python execution; this is disclosed and central to the date-math purpose.

Skill content
Use `exec` to run the bundled script instead of doing date math yourself.
Recommendation

Install only if you are comfortable with the agent executing this bundled script, and review any future edits to the file before relying on it.

What this means

For unknown events, the agent may search the web instead of immediately asking you for the date.

Why it was flagged

The workflow allows an external lookup for unknown named events before asking the user; this is purpose-aligned but could disclose the event name to a search provider.

Skill content
Still unsure? Web search. STILL unsure? Ask which occurrence they mean.
Recommendation

If an event name is private or internal, tell the agent not to web-search it and provide the date directly.

What this means

Any custom event names or dates added to the script can persist locally and influence future date calculations.

Why it was flagged

The documentation supports persistent local customization of named dates, so added goals may be reused in later answers.

Skill content
Edit `~/.openclaw/workspace/skills/time-anchor/scripts/time-anchor.py`, add to the `TARGETS` dict
Recommendation

Avoid storing sensitive event names in the TARGETS dictionary, or keep labels generic if the skill directory may be shared or backed up.