Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Qordinate - Durable lists, facts, and reminders for OpenClaw agents.
v1.0.1Qordinate is a chat-native assistant that acts as structured memory for your agents. Use this skill when you want your OpenClaw agent to offload long-term facts, tasks, and reminders into Qordinate over WhatsApp, Telegram, or Slack instead of managing its own database.
⭐ 2· 672·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (structured memory via chat) matches the SKILL.md: it explicitly instructs the agent how to create, update, and query lists by sending chat messages to Qordinate on WhatsApp/Telegram/Slack. There are no unrelated credentials, binaries, or installs requested.
Instruction Scope
Instructions require the agent to send natural-language messages containing structured user data (tasks, contacts, reminders) to third-party chat endpoints. This is within the stated purpose, but it means the agent will transmit user data to an external service. The SKILL.md also requires the agent be able to control/send messages as the user (desktop/web client), which is an operational privilege not described in registry metadata.
Install Mechanism
No install spec and no code files — instruction-only skill. Nothing is written to disk or downloaded during install, which is low-risk from an install-mechanism perspective.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, it implicitly depends on the agent having the ability to send messages as the user (access to WhatsApp/Telegram/Slack clients or automation), which effectively grants access to the user's messaging channel. That capability is not declared as an explicit requirement in requires.env and represents a notable operational permission.
Persistence & Privilege
always is false and the skill is user-invocable only. It does not request persistent system presence or modify other skills. Model invocation is allowed (platform default); this combined with the need to send messages means an autonomously-invoked agent could contact Qordinate, but that behavior is consistent with the skill’s purpose.
What to consider before installing
This skill is coherent for delegating memory to an external chat-based service, but before installing: 1) verify qordinate.ai is a legitimate, trustworthy service (privacy, retention, access controls); 2) confirm the contact addresses (the listed phone number uses a 555 example-style number) and test with non-sensitive dummy data first; 3) limit the agent's messaging permissions — avoid granting broad control of your messaging clients unless necessary; 4) check corporate policy if you handle sensitive data — sending internal contacts/tasks to an external third party may violate policy; and 5) prefer solutions where the integration uses explicit, auditable API credentials or enterprise-approved connectors rather than an agent sending ad-hoc chat messages on behalf of the user.Like a lobster shell, security has layers — review code before you run it.
latestvk977zbzpjqw9q5v6qsqht0rh9n80pdw9learningvk977zbzpjqw9q5v6qsqht0rh9n80pdw9memoryvk977zbzpjqw9q5v6qsqht0rh9n80pdw9relationalvk977zbzpjqw9q5v6qsqht0rh9n80pdw9sqlvk977zbzpjqw9q5v6qsqht0rh9n80pdw9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.