Briefing (Calendar Agenda, Weather, Pending To-Dos)
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: briefing Version: 2.1.0 The skill bundle is designed for a daily briefing, orchestrating calls to companion skills for calendar, todos, and weather. The `SKILL.md` provides clear, restrictive instructions to the AI agent, emphasizing no data fabrication and strict output formatting. The only direct command executed, `openmeteo weather --city="{city}"`, uses double quotes around the `{city}` variable, which, under standard shell interpretation, prevents shell injection by treating the entire content as a single argument. The `README.md` explicitly confirms this intent, stating 'The city name is quoted in the command to prevent shell interpretation.' There is no evidence of data exfiltration, persistence mechanisms, or malicious prompt injection attempts. All network access is delegated to companion skills and is for legitimate services (Open-Meteo API, Google Calendar API).
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The briefing can include private calendar information from the user's Google account.
The skill may indirectly use the user's Google Calendar account through a companion skill, which is expected for a calendar briefing but involves account-backed personal data.
gcalcli connects to Google Calendar API (requires user's own OAuth credentials, configured outside this skill).
Install only if you are comfortable with the configured calendar companion skill being used for briefings, and review that companion skill's permissions separately.
If configured, the skill can run automatically on a schedule and deliver calendar, todo, and weather summaries to the selected channel.
The README recommends a persistent scheduled invocation, but it is presented as an optional, explicit user setup and is aligned with the daily briefing purpose.
This skill works best as a scheduled cron job that fires every morning at your wake time.
Use the scheduled setup only for channels where you are comfortable receiving personal briefing content, and periodically review or remove the cron job if no longer needed.