Scheduly
v1.0.0A scheduling and booking management platform with Google Calendar integration, event type management, availability rules, and time slot booking capabilities.
⭐ 0· 35·0 current·0 all-time
byToolWeb@krishnakumarmahadevan-cmd
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (scheduling, event types, availability, Google Calendar sync) matches the SKILL.md examples and the provided OpenAPI paths. There are no unrelated required env vars, binaries, or config paths requested that would contradict the claimed purpose.
Instruction Scope
SKILL.md is instruction-only and documents REST calls to a remote API (https://api.toolweb.in/tools/scheduly) and Google OAuth endpoints. The instructions do not ask the agent to read local files, environment variables, or other system state outside of constructing API requests. They do direct user data (names, emails, booking notes, and OAuth tokens) to an external service, which is expected for a scheduling integration.
Install Mechanism
No install spec or code is included (instruction-only), so nothing is written to disk or installed by the skill. This is the lowest-risk install posture and matches the skill content.
Credentials
The skill requests no environment variables or credentials from the agent. However, it relies on an external OAuth flow (Google) — users will grant the remote service access to their Google Calendar and the service will hold tokens. The SKILL.md also mentions paid actions (500 coins per event-type creation) but does not explain payment credentials or where coins are billed; this is a functional detail to verify with the service provider.
Persistence & Privilege
The skill does not request permanent presence (always flag is false), does not include install-time behaviors, and does not modify other skills or agent-wide settings. Autonomous invocation is allowed by default but is not combined with other concerning privileges here.
Assessment
This skill appears internally consistent for a scheduling API: it will make requests to an external domain (api.toolweb.in) and prompt Google OAuth so that the remote service can access your calendar. Before installing or using it, verify the remote service and privacy policy (there's no homepage/source provided), review the OAuth scopes you'll be granting, and confirm how 'coins' / payments are handled and billed. Avoid sharing unrelated secrets or platform credentials; if you plan to connect a Google account, inspect the consent screen carefully and consider using an account with limited permissions if you have concerns. If you need stronger assurance, ask the publisher for a homepage, source repo, or documentation describing token storage, retention, and billing.Like a lobster shell, security has layers — review code before you run it.
latestvk97atqp10j3yznx2btebe7awdh83zk39
License
MIT-0
Free to use, modify, and redistribute. No attribution required.