Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Clawhub Skill Smart Cron

v1.0.0

Schedule OpenClaw tasks using natural language with full cron lifecycle, timezone support, failure alerts, and execution logs without needing cron syntax.

0· 454·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the instructions: natural-language scheduling mapped to system cron, job lifecycle, timezones, and local logs are coherent with a scheduler. The skill also claims failure alerts and next-run previews which are reasonable features for such a tool.
Instruction Scope
SKILL.md is an instruction-only spec that expects a CLI (smart-cron) to add/list/remove jobs and store data under ~/.openclaw/workspace/smart-cron-data/. It permits running arbitrary OpenClaw tasks (expected for a scheduler) and persisting logs locally. However, it refers to sending failure alerts (WhatsApp/Telegram) without describing how credentials or endpoints are obtained or used; the instructions give the scheduler broad discretion to run arbitrary tasks which could execute any command or network access — this is expected functionally but increases the need to inspect the implementation.
Install Mechanism
There is no install spec and no code files bundled with the skill (instruction-only). That minimizes direct installer risk; nothing will be downloaded or written by the registry-install process itself. Risk now depends on the external implementation referenced in SKILL.md (the GitHub repo).
!
Credentials
The skill declares no required environment variables or credentials, yet SKILL.md says it can send alerts via WhatsApp/Telegram and mentions an alert_channel in config.json. Sending messages via those services normally requires API tokens or external integrations; the lack of declared credentials or explanation for how messaging is authenticated is an incoherence. This could be benign if it uses OpenClaw's own 'message' tool tied to the user's agent identity, but the spec doesn't state that explicitly — so the requested environment access is underspecified.
Persistence & Privilege
always is false and user-invocable is true. The skill stores job configs/logs under the user's home (~/.openclaw/workspace/smart-cron-data/), which is reasonable for a scheduler. It does not request system-wide changes in the manifest or ask to modify other skills' configs in the provided materials.
What to consider before installing
This skill's purpose (natural-language cron management) is believable, but there are important gaps before you should install it: - Confirm how failure alerts are delivered. SKILL.md mentions WhatsApp/Telegram alerts and an alert_channel config but the skill declares no API keys or integration steps. Ask the author or inspect the referenced GitHub repo to see whether it uses OpenClaw's built-in messaging, third‑party APIs (which require tokens), or a user-side client. - Review the implementation on the claimed GitHub repository (https://github.com/mariusfit/smart-cron) before running it. Because the skill runs arbitrary tasks, the code can execute any command and make network requests — verify there is no hidden exfiltration or unexpected outbound endpoints. - Check the exact mechanism used to modify cron (crontab entries). Ensure it runs only under your user account and doesn't require elevated privileges you don't want to grant. - Inspect stored data under ~/.openclaw/workspace/smart-cron-data/ for sensitive logs and ensure retention/rotation settings are appropriate. - If you need message alerts, prefer explicit credential configuration and minimal required scopes; do not provide broad tokens without understanding where they are stored and who can read them. If you cannot or will not review the code, consider running the tool in an isolated environment (container or dedicated VM) and deny it unnecessary network or host permissions. Additional information that would raise my confidence to 'high': the actual implementation source code (or a vetted package), clear documentation of how alerts are authenticated, and a description of what OpenClaw 'message' tool does and what permissions it uses.

Like a lobster shell, security has layers — review code before you run it.

latestvk9705xy4yh220bkd75aebf02gh81veaq
454downloads
0stars
1versions
Updated 5h ago
v1.0.0
MIT-0

Smart Cron — Natural Language Cron Scheduler for OpenClaw

Schedule any OpenClaw task using plain English. No cron syntax required. Just say what you want, when you want it.

What It Does

  • Natural language scheduling — "every weekday at 9am", "every 30 minutes", "first Monday of month"
  • Full cron job lifecycle — add, list, remove, pause, resume
  • Timezone-aware — schedule in any timezone (UTC, Europe/Bucharest, etc.)
  • Failure alerts — WhatsApp/Telegram alert if a job fails
  • Next run preview — shows exactly when each job runs next
  • Run logs — persisted history of every execution
  • Zero external dependencies — uses system cron + OpenClaw orchestration

Quick Start

# Add a daily digest job
smart-cron add "every weekday at 9am" --task "summarize my emails"

# Add an interval job
smart-cron add "every 30 minutes" --task "check server health"

# Monthly job
smart-cron add "first Monday of month at 10am" --task "generate monthly report"

# List all scheduled jobs
smart-cron list

# Show next run times
smart-cron next

# View job logs
smart-cron logs

# Pause a job (without deleting it)
smart-cron pause <job-id>

# Resume paused job
smart-cron resume <job-id>

# Remove a job
smart-cron remove <job-id>

Commands

CommandDescription
smart-cron add <schedule> --task <task>Schedule a new task
smart-cron listList all jobs with status
smart-cron remove <id>Remove a job
smart-cron nextShow next run time for all jobs
smart-cron run <id>Run a job immediately
smart-cron logs [id]View execution logs
smart-cron pause <id>Pause a job
smart-cron resume <id>Resume a paused job

Supported Schedule Expressions

Intervals

  • every 5 minutes*/5 * * * *
  • every hour0 * * * *
  • every 2 hours0 */2 * * *
  • every 30 minutes*/30 * * * *

Daily

  • every day at 9am0 9 * * *
  • every weekday at 9am0 9 * * 1-5
  • every weekend at noon0 12 * * 6,0
  • daily at midnight0 0 * * *

Weekly

  • every Monday at 8am0 8 * * 1
  • every Friday at 5pm0 17 * * 5

Monthly

  • first Monday of month → calculated and re-scheduled
  • 1st of month at 9am0 9 1 * *
  • last day of month → calculated dynamically

Custom cron (passthrough)

  • 0 */6 * * * → runs as-is for advanced users

Timezone Support

# Schedule in your local timezone
smart-cron add "every weekday at 9am" \
  --task "daily standup reminder" \
  --timezone Europe/Bucharest

# List shows times in both UTC and local tz

Failure Alerts

When a scheduled task fails, Smart Cron sends an alert via your configured channel:

⚠️ Smart Cron: "daily standup reminder" FAILED
Time: 09:00 EET (07:00 UTC)
Error: Task timed out after 300s
Last success: yesterday at 09:00
Logs: smart-cron logs job-123

Data Storage

All job configs and logs stored locally at ~/.openclaw/workspace/smart-cron-data/. SQLite, no telemetry.

Configuration

Edit ~/.openclaw/workspace/smart-cron-data/config.json:

{
  "default_timezone": "Europe/Bucharest",
  "alert_channel": "whatsapp",
  "alert_on_failure": true,
  "log_retention_days": 30
}

Use Cases

Morning Briefing

smart-cron add "every weekday at 8am" --task "summarize overnight emails and news"

Uptime Monitoring

smart-cron add "every 5 minutes" --task "check all APIs and alert if any is down"

Weekly Reports

smart-cron add "every Friday at 5pm" --task "generate weekly work summary and log to MEMORY.md"

Monthly Cleanup

smart-cron add "1st of month at 2am" --task "clean old logs and archive memory files older than 90 days"

Requirements

  • OpenClaw 1.0+
  • Python 3.8+ (for schedule parsing)
  • cron daemon (standard on Linux/macOS)

Source & Issues

Comments

Loading comments...