Project Management Guru (ADHD)
v1.0.0Expert project manager for ADHD engineers managing multiple concurrent projects. Specializes in hyperfocus management, context-switching minimization, and parakeet-style gentle reminders.
⭐ 3· 2.7k·16 current·16 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill describes active integrations (Slack DMs, calendar API, GitHub webhooks, scheduling) and runtime behaviors (monitoring commits/DND, sending reminders). Yet the registry metadata declares no required env vars, no config paths, and no install steps. Realistically those capabilities need API tokens/URLs and webhook setup; the absence of any declared credentials or integration configuration is an incoherence.
Instruction Scope
SKILL.md and reference files contain explicit instructions to call functions like send_slack_dm, schedule_task, schedule_followup_checkin, prompt_user and to read calendar/events/commit activity. Those are actionable runtime operations that go beyond passive advice — they require network access and credentials. The instructions do not declare how those functions will be provided nor constrain what data may be read or sent.
Install Mechanism
There is no install spec and no code files executed by the platform; this lowers file-system/write risk. The included reference files contain example code snippets, but nothing in the package automatically downloads or installs external code.
Credentials
The skill clearly expects access to external services (Slack, calendar, GitHub, optional time-tracking), yet requires.env is empty and no primaryEnv is declared. If the skill were to be granted tokens later, it should request minimal, narrowly-scoped credentials (e.g., a Slack bot token limited to sending DMs). As-is, the spec gives no justification for how credentials would be supplied or limited.
Persistence & Privilege
always:false (normal). The skill allows autonomous model invocation (default). Autonomous invocation combined with networked integrations would increase blast radius, but autonomy alone is expected for skills. If you grant service credentials, consider the implications of enabling autonomous runs that can send messages or schedule actions without per-invocation approval.
Scan Findings in Context
[unicode-control-chars] unexpected: The scanner found unicode control characters in SKILL.md, which can be used for prompt-injection or to obfuscate instructions. This is not expected for a straightforward PM guidance doc and should be inspected manually (e.g., view raw bytes) before trusting or installing.
What to consider before installing
This skill reads like a design + implementation guide for an automated reminder/monitoring system, but the package declares no credentials or install steps — that's a mismatch. Before installing or enabling it:
- Ask the publisher for the source repository and a security/privacy description (what APIs it will call, exactly which tokens are required, and why).
- Do not provide broad tokens (full workspace/admin). If you must supply credentials, use least-privilege service accounts (Slack bot scoped only to sending DMs, calendar read-only where possible).
- Inspect SKILL.md for hidden unicode/control characters (the scan found them); view the raw file to ensure there are no obfuscated instructions.
- Confirm how 'send_slack_dm', 'schedule_task', webhooks, and 'prompt_user' are implemented in your environment — these are referenced but not provided.
- If you plan to let the skill run autonomously, test it in a sandboxed account/workspace first and audit outgoing messages and scheduled actions.
If the owner cannot explain the missing integration configuration or provide a canonical source repo, treat the skill as untrusted and do not grant credentials or enable autonomous invocation.Like a lobster shell, security has layers — review code before you run it.
adhdvk97bkw4yhy1h6swnpq71bg5z3s805nt1hyperfocusvk97bkw4yhy1h6swnpq71bg5z3s805nt1latestvk97bkw4yhy1h6swnpq71bg5z3s805nt1productivityvk97bkw4yhy1h6swnpq71bg5z3s805nt1project-managementvk97bkw4yhy1h6swnpq71bg5z3s805nt1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.