Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Chronos

通用周期任务管理器 - 支持6种周期类型、每月N次配额、自动cron、统一视图,适用于所有定时任务场景

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 44 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (periodic task manager) aligns with the code and requested binaries: sqlite3 is used for todo.db and openclaw is used to schedule/remove cron reminders. However the code hardcodes paths under /home/ubuntu/.openclaw/workspace and calls scripts outside the skill (e.g., /home/ubuntu/.openclaw/workspace/scripts/prediction_logger.py), which is not explicit in the top-level metadata and broadens the effective scope.
!
Instruction Scope
SKILL.md describes running todo.py and periodic_task_manager.py only. The implementation uses subprocess to call the openclaw CLI to add/remove cron jobs and to invoke a prediction_logger.py outside the skill. Those external calls can transmit task names/outcomes and interact with the larger OpenClaw environment; this behavior is not fully documented in SKILL.md and expands what the skill does at runtime.
Install Mechanism
No install spec / no network downloads — this is an instruction+code skill intended to be cloned into the workspace. No remote installers or archive extracts were observed, so installation risk is low. (Risk remains because the code will be placed and executed on the host when installed.)
Credentials
The skill declares no required env vars but expects the openclaw CLI and a workspace at /home/ubuntu/.openclaw/workspace (TODO_DB path). It accesses other workspace scripts (prediction_logger.py) and the shared todo.db; while these are consistent with an OpenClaw skill, they grant the skill access to data and to other scripts it did not ship with — a broader access footprint than the simple 'todo manager' description implies.
Persistence & Privilege
always is false and the skill is user-invocable. It schedules one-shot cron jobs via the openclaw CLI (normal for a scheduler) but does not request permanent platform-wide privileges in the metadata. Cron scheduling increases its operational reach (it will cause future events), which is expected for this functionality.
What to consider before installing
This skill appears to implement the stated scheduling features, but it calls external components in your OpenClaw workspace and the openclaw CLI to schedule system events. Before installing: (1) Inspect /home/ubuntu/.openclaw/workspace/scripts/prediction_logger.py — it will receive task names/outcomes (could forward data). (2) Backup your todo.db and review the migration logic (skill claims it auto-deleted old tables). (3) Confirm you trust the openclaw CLI on the host (cron jobs will create system events/sessions). (4) Consider running the skill in an isolated/test workspace first to observe what external endpoints receive the data. (5) If you need tighter control, request the skill author to remove calls to external workspace scripts or to make those integrations optional/configurable.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.3.0
Download zip
cronvk975at4kjcn50k3fgqncfkzx9h831kgxlatestvk97adyn08p27kp9xvrapns3wvs8316rrperiodicvk975at4kjcn50k3fgqncfkzx9h831kgxtodovk975at4kjcn50k3fgqncfkzx9h831kgx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Clawdis
Binssqlite3, openclaw

SKILL.md

Chronos - Universal Periodic Task Manager

What this skill controls

  • 周期任务表periodic_tasks + periodic_occurrences(在 ./todo.db
  • 原 todo 表entries(兼容旧一次性任务)
  • 统一入口todo.py

Capabilities

周期类型

  • once:一次性
  • daily:每天
  • weekly:每周(指定星期几)
  • monthly_fixed:每月固定日期(如15号)
  • monthly_range:每月区间(如11号→5号,跨月)
  • monthly_n_times:每月限次(如每周三,每月最多2次)

智能配额

  • completed 计数,skip 不计
  • 配额用满后自动完成当月剩余活动日
  • 每月1号自动重置计数器

自动提醒

  • Cron 任务自动生成(未来事件)
  • 每日自动清理过期 cron
  • 时间已过则跳过(避免错误)

统一视图

  • todo.py list:合并显示周期任务和普通任务
  • todo.py add:智能路由(周期任务 → manager,一次性 → entries)
  • todo.py complete:完成单个 occurrence 或普通任务
  • todo.py show:查看详情

Usage

# 列出所有待办(自动确保今天 occurrence 已生成)
python3 skills/chronos/scripts/todo.py list

# 添加周期任务(例如:每月2次,每周三10:00)
python3 skills/chronos/scripts/todo.py add "周三抢券" \
  --cycle-type monthly_n_times \
  --weekday 2 \
  --n-per-month 2 \
  --time 10:00

# 添加一次性任务
python3 skills/chronos/scripts/todo.py add "买牛奶" --category 生活

# 完成任务
python3 skills/chronos/scripts/todo.py complete FIN-123  # 周期任务 occurrence
python3 skills/chronos/scripts/todo.py complete 45      # 普通任务 ID

# 查看详情
python3 skills/chronos/scripts/todo.py show FIN-123

Database Schema

periodic_tasks

  • id, name, category, cycle_type, weekday, day_of_month, range_start, range_end, n_per_month
  • time_of_day, event_time, timezone, is_active, count_current_month, created_at, updated_at

periodic_occurrences

  • id, task_id, date, status (pending/reminded/completed/skipped)
  • reminder_job_id, is_auto_completed, completed_at

entries + groups

  • 旧表,用于一次性任务,保留兼容

Migration

financial_activitiesfinancial_occurrences 数据已自动迁移到新表。旧表已删除。

Notes

  • 所有时间基于 Asia/Shanghai 时区
  • Cron 提醒转换为 UTC 后提交给 Gateway
  • todo.py list 调用 --ensure-today 轻量生成(不安排 cron),完整 cron 由每日 manager 负责
  • 双环学习集成在 periodic_task_manager.py 的关键操作中

Files

9 total
Select a file
Select a file to preview.

Comments

Loading comments…