Henteplan Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears purpose-aligned for checking waste pickup dates, with the main things to notice being address lookup through henteplan.no and optional saved reminders.

This skill looks benign for its stated purpose. Before using it, be comfortable sending your address or locationId to henteplan.no, decide whether you want the agent to remember those details, and only set up the optional daily reminder if you want recurring automated checks.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may make network requests to henteplan.no when helping look up a schedule.

Why it was flagged

The skill relies on shell command examples using curl and jq to query the schedule API. This is expected for an instruction-only lookup skill and is scoped to the documented API.

Skill content
curl -s --max-time 10 "https://henteplan.no/api/v1/search?q=Kongens+gate+1" | jq .
Recommendation

Use the skill when you intend to query that service, and avoid providing more address detail than needed.

What this means

The skill may not work unless curl and jq are available, despite the registry requirements saying no binaries are needed.

Why it was flagged

SKILL.md declares required binaries, while the supplied registry metadata says no required binaries. This is an install/dependency metadata mismatch rather than hidden code.

Skill content
required_bins:
  - curl
  - jq
Recommendation

Ensure curl and jq are installed if you plan to use the documented commands.

What this means

Your postal code, city, street address, provider, or locationId may be sent to henteplan.no to find your waste pickup schedule.

Why it was flagged

The workflow sends address-related information to the external henteplan.no API. This is necessary for the lookup, but it involves location data.

Skill content
Ask for their street address, search within the detected provider.
Recommendation

Only provide address information you are comfortable sending to the service.

What this means

Future interactions may reuse your saved waste-provider location details without asking you to re-enter your address.

Why it was flagged

The skill asks the agent to retain provider and locationId for future use. This is useful and purpose-aligned, but it persists a location-linked identifier.

Skill content
Save for later — Remember the user's `provider` and `locationId` so future queries skip steps 1-2.
Recommendation

If you do not want location details retained, ask the agent not to remember them or to delete them later.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If you set it up, OpenClaw may check your schedule daily and send reminders using the saved provider and locationId.

Why it was flagged

The skill documents an optional recurring reminder job. It is user-directed and scoped to tomorrow's pickup check, but it creates ongoing autonomous activity.

Skill content
openclaw cron add \
  --name "waste-reminder" \
  --schedule "0 20 * * *"
Recommendation

Create the cron or HEARTBEAT reminder only if you want recurring checks, and know how to disable it.