Olympic Alert

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward Olympic schedule alert skill with disclosed local Python execution and small local state storage, but no evidence of credential use, exfiltration, or hidden behavior.

This skill looks safe for its stated purpose. Before enabling it, note that recurring heartbeat setup will repeatedly run the included Python checker, and the actual alert window appears to be 15 minutes despite some documentation mentioning 10 or 30 minutes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI05: Unexpected Code Execution

What this means

Installing and using the skill means allowing the agent or user workflow to run the included Python checker script.

Why it was flagged

The skill is designed to run a local Python script. This is clearly documented and central to its reminder functionality.

Skill content

python3 "$SKILL_DIR/scripts/check_olympic.py"

Recommendation

Review the included script before enabling it, especially if adding it to a recurring heartbeat workflow.

Low

#ASI10: Rogue Agents

What this means

If configured, the agent may run the checker on every heartbeat and send notifications when events are near.

Why it was flagged

The skill recommends recurring autonomous execution through HEARTBEAT. This is disclosed and purpose-aligned for alerts, but users should understand it may run repeatedly once configured.

Skill content

On each heartbeat:
1. Run `python3 <skill_dir>/scripts/check_olympic.py`
2. If output is not "알림 없음" → 사용자에게 알림 전송

Recommendation

Enable the heartbeat only if you want recurring alerts, and remove or disable the heartbeat entry when the Olympics or your use case is over.

Info

#ASI06: Memory and Context Poisoning

What this means

A small local history of sent Olympic alerts will remain on the device until deleted.

Why it was flagged

The script writes a persistent local state file to remember which event alerts have already been sent. The stored data appears limited to event identifiers.

Skill content

STATE_DIR = Path(os.path.expanduser("~/.config/olympic-alert"))
STATE_FILE = STATE_DIR / "state.json"

Recommendation

Delete ~/.config/olympic-alert/state.json if you want to reset notifications or remove the skill’s local state.