Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed cron-style scheduler for OpenClaw tasks with persistent local jobs and optional failure alerts, and I found no hidden code or deceptive behavior.
Install this only if you want OpenClaw tasks to run persistently through cron. Review each scheduled task before adding it, especially tasks that read email, write memory files, call APIs, delete logs, or archive data. If you enable WhatsApp or Telegram alerts, assume job names and error details may be sent to that provider or recipient.
The markdown documents smart-cron remove <job-id> and later a cleanup use case that archives or removes old data, but it does not explicitly warn users that these actions can delete scheduled jobs or affect stored files. For a skill that manages persistent schedules and logs, the description should disclose irreversible or data-affecting behavior.
The failure-alert feature explicitly sends job names, timing, error details, and log references over external messaging channels such as WhatsApp or Telegram without any privacy warning or data-minimization guidance. Because scheduled tasks may contain sensitive business or personal information, this can leak confidential context to third-party services or unintended recipients.
This is a manifest file, so vague-trigger checks apply. The description advertises activation via generic plain-English phrases like 'Every weekday at 9am' and 'every 30 minutes' but does not specify how the skill is invoked, what command scope applies, or any exclusion conditions, which can make triggering behavior ambiguous in systems that rely on manifest text for routing.
No suspicious patterns detected.
