Webhook Promo Scheduler

• Risk level: Low
• Analyzed: Feb 17, 2026, 4:07 PM
• Findings: 0
• Version: 0.1.1

Overview

The skill's code, instructions, and resource needs align with its stated purpose (posting to a provided Discord webhook with a JSONL anti-spam ledger); nothing requested or installed appears disproportionate or covert.

This skill appears to do what it says: post to a Discord webhook while tracking posts in a local JSONL ledger. Before installing, consider: (1) keep the webhook secret—avoid passing it directly on the command line on multiuser systems (use the platform's secret injection or stdin/agent-secret forwarding if available) because CLI args can be visible to other users; (2) the ledger defaults to ~/.openclaw/webhook-promo-ledger.jsonl—verify you’re comfortable with that file and its permissions or override with --ledger-path; (3) use --dry-run to validate behavior and rotate the webhook if you suspect leakage; (4) review and run the scripts in a controlled environment first since they will perform outbound HTTP POSTs to whatever URL you provide.