Edsby Grades Board
v1.0.1Fetches Edsby student data to generate grade reports, provide bi-weekly summaries with tips, and sync assignments to Google Calendar.
⭐ 0· 916·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name and SKILL.md describe Edsby data fetch + Google Calendar sync and the index.js implements that using Playwright and googleapis — so the functionality matches the purpose. However, the registry metadata lists no required environment variables or config paths while both SKILL.md and index.js require multiple env vars (EDSBY_HOST, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, GOOGLE_CALENDAR_ID, BROWSER_CONTEXT_PATH) and read/write local files (google-tokens.json and persistent browser context). This mismatch is incoherent and should have been declared.
Instruction Scope
SKILL.md and index.js instruct the agent to launch persistent browser contexts, perform interactive OAuth, scrape pages under the EDSBY_HOST domain, parse DOM selectors, and write/expect local token files. Those actions are within the claimed scope (fetching grades/assignments and syncing calendar), but they also imply broad access to local filesystem and any browser profile provided via BROWSER_CONTEXT_PATH. Instructions around 'scheduled checks' and 'persistent sessions' mean this skill may repeatedly access user data autonomously if invoked — the runtime instructions are not narrowly scoped and rely on local files not declared to the registry.
Install Mechanism
There is no explicit install spec in the registry, but package.json lists substantial dependencies (playwright and googleapis). Playwright will typically download browser binaries during install which increases footprint and network activity. The absence of an install spec combined with heavy dependencies is a moderate concern (it is traceable/public packages, not an arbitrary URL), but users should be aware of the extra browser downloads and system requirements.
Credentials
The code requires multiple sensitive environment settings and credentials (Google OAuth client ID/secret, redirect URI, calendar ID, and an Edsby host), but the registry metadata declares none. The skill also expects and reads a local file 'google-tokens.json' (persisted OAuth tokens) and uses a persistent browser context path (defaulting to HOME). Requesting and storing OAuth tokens and persistent browser sessions is proportionate to the stated functionality, but not declaring these requirements is a red flag; additionally, using a browser context path could allow access to unrelated browser data if misconfigured.
Persistence & Privilege
always:false (normal) and the skill does not request system-wide configuration changes. However, it persists browser contexts and token files to disk and provides a 'daily check' tool that could be scheduled or invoked automatically by the agent. Combined with the credential handling above, persistent on-disk tokens and browser profiles increase blast radius if the skill is granted those credentials and allowed autonomous invocation.
What to consider before installing
Key things to consider before installing:
- The registry metadata does not list the env vars the code needs. Ask the publisher to explicitly declare: EDSBY_HOST, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, GOOGLE_CALENDAR_ID, and BROWSER_CONTEXT_PATH.
- The skill stores OAuth tokens in a local file named google-tokens.json and uses a persistent browser context directory. Confirm where those files will live, and prefer a dedicated, isolated path (not your regular browser profile or a directory with other sensitive data).
- Playwright will download browser binaries during install — expect extra disk usage and network activity. Consider running this skill in an isolated environment (container or VM).
- If you plan to grant Google OAuth credentials, rotate them if you uninstall the skill. Inspect the token file contents and store tokens in a secure secrets store if possible rather than plaintext files.
- If you cannot confirm the publisher or fix the metadata omissions, treat this as higher-risk and avoid giving real credentials or persistent browser profiles to the skill. Request the author to fix the registry entries and to document secure token handling and installation steps.Like a lobster shell, security has layers — review code before you run it.
latestvk972em3qdd1av22kxg73t16601810v71
License
MIT-0
Free to use, modify, and redistribute. No attribution required.