Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Vesper
v2.7.0Daily briefing generator. Aggregates signals from across the system into concise morning and evening briefings. Surfaces outcomes, opportunities, and decisio...
⭐ 0· 154·0 current·0 all-time
byIndigo Karasu@indigokarasu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (daily briefing aggregator) aligns with the instructions to read proposals and assemble briefings. However skill.json declares filesystem read access to ~/openclaw/data/*/intake/ (all skills' intake directories), which is broader than a narrowly scoped aggregator would typically need and could expose unrelated sensitive inputs.
Instruction Scope
SKILL.md explicitly instructs the agent to read other skills' proposal directories, apply filtering, write briefings and journals, and preserve processed IDs. Those actions are coherent with an aggregator. There are no instructions that clearly attempt to exfiltrate data to unknown remote endpoints. It does reference external Calendar/Weather APIs and link formatting, which is expected for briefings.
Install Mechanism
The skill is instruction-only (no install spec) so there's no immediate download risk. But SKILL.md and README mention a self-update flow (openclaw skill install <github>, and skill.json documents a 'gh CLI + tar + python3' version-checked tarball update). The registry metadata elsewhere lists no required binaries — an inconsistency worth confirming before enabling automatic self-updates.
Credentials
Declared required env vars: none. But skill.json's filesystem policy (read: ~/openclaw/data/*/intake/) and the SKILL.md's explicit reads from other skills' proposal directories give it wide read access across the agent's skill data. That breadth is larger than strictly necessary to read a small set of proposal files and could surface unrelated sensitive content from other skills. Also self-update claiming gh/tar/python implies dependencies not declared in the lightweight manifest.
Persistence & Privilege
always:false (normal). The skill requests scheduled tasks (morning/evening/update) and the README describes registering cron jobs on init — that's persistent behavior but appropriate for a briefing service. Confirm whether the platform enforces or approves cron registration; automatic self-updates plus scheduled runs increase blast radius if the skill is later compromised.
What to consider before installing
This skill appears to do what it claims — aggregate proposals and produce briefings — but review these before enabling it:
- Confirm the filesystem read scope: skill.json allows reading ~/openclaw/data/*/intake/. Ask whether it can be limited to the specific skills it needs (e.g., ocas-corvus, ocas-rally) rather than the wildcard that touches every skill's intake.
- Self-update inconsistency: the registry lists no required binaries but the skill declares a gh/tar/python3 update mechanism. Verify whether gh/tar/python3 are present and whether automatic self-updates are acceptable; consider disabling auto-update until you review the GitHub source.
- Scheduled tasks / cron registration: the skill expects to register cron jobs. Ensure your platform/operator policy allows skills to create scheduled jobs and review what happens if the skill is removed or updated.
- Data exposure: the skill writes journals and briefings to local directories (journals/ and briefings/) and creates inline links (calendar/gmail/maps). Make sure those output directories are acceptable destinations for user-facing content and do not leak private IDs to unintended consumers.
- Source trust: the SKILL.md references a GitHub repo; if you plan to install, inspect that repository (or require a pinned release) to confirm there is no hidden behavior.
Given the broad read permission and self-update inconsistencies, proceed only after narrowing filesystem access and confirming update/install behavior. If you want, I can list the exact paths and manifest lines that are most concerning or draft a permission-limited manifest you could request from the author.Like a lobster shell, security has layers — review code before you run it.
latestvk97e7v2f5d0mhmar2wh2p3kagx847pfv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.