Educlaw Ielts Planner

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent IELTS study-planning skill, but it needs calendar access, local progress storage, and optional automated notifications that users should configure carefully.

Install this only if you are comfortable giving the agent/gcalcli read-write access to Google Calendar and configuring API or bot tokens. Review every plan before approving calendar changes, use private notification channels, and enable cron jobs only if you want ongoing automated reminders and reports.

Findings (6)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can use your authenticated Google Calendar session to inspect availability and create study events.

Why it was flagged

The skill uses the local gcalcli OAuth credential store to read and write Google Calendar data, which is expected for calendar scheduling but grants meaningful account access.

Skill content
"path": "~/.gcalcli_oauth", "access": "read-write", "description": "Google OAuth credentials file created and used by gcalcli."
Recommendation

Use a dedicated calendar or account if possible, review the OAuth scope, and revoke gcalcli access if you stop using the skill.

What this means

Approved plans can result in calendar events being created without an additional gcalcli prompt.

Why it was flagged

The workflow can create Google Calendar events using gcalcli. The artifacts include approval gates before this action, so the tool use is purpose-aligned but still changes a third-party account.

Skill content
DO NOT proceed to Step 2 until user confirms. ... gcalcli --nocolor add --noprompt
Recommendation

Review the proposed plan carefully before approving calendar creation, and verify the created events afterward.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If you enable cron jobs, the agent may periodically read study/calendar state and post reminders or reports without a fresh prompt.

Why it was flagged

The skill supports persistent scheduled automation. It is disclosed and appears user-configured, but it can keep running after initial setup.

Skill content
### Cron (Automated — no user trigger needed)\n- Daily study reminders → delivered to Discord\n- Weekly progress reports → delivered to Discord
Recommendation

Only enable the cron jobs you actually want, review their messages and schedules, and remove them when no longer needed.

What this means

Your study history, scores, weak areas, vocabulary, and materials may be saved locally and reused across sessions.

Why it was flagged

The skill persists study progress and uses it in future planning and reports. This is expected for a study tracker, but it creates stored personal context.

Skill content
SQLite Progress Database — Local `educlaw.db` with sessions, vocabulary, materials, and weekly summary tables
Recommendation

Keep the workspace private, back up or delete the database as appropriate, and avoid storing sensitive non-study information in the plan.

What this means

Study reminders, progress reports, or calendar-conflict information could be visible to anyone with access to the configured channel.

Why it was flagged

The skill can send progress and reminder content to Discord, with optional Telegram support. This is part of the stated reminder feature but moves personal study data into chat channels.

Skill content
"host": "discord.com", "purpose": "Send study reminders and progress notifications via Discord bot."
Recommendation

Use a private Discord or Telegram channel, restrict bot permissions, and avoid posting sensitive calendar details to shared servers.

What this means

Following the setup guide may install software from the network onto your machine.

Why it was flagged

The setup guide includes user-directed external installer/package commands. They are not automatically executed by the skill, but they rely on external sources.

Skill content
curl -fsSL https://get.openclaw.dev | bash
Recommendation

Review installer sources, prefer official package managers or pinned versions where possible, and avoid running commands you do not trust.