Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

corn-manager-master

v1.0.0

定时任务创建通用技能。自动提取当前对话上下文,标准化创建和检查OpenClaw定时任务。

1· 94·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jasonfc888/corn-manager-master.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "corn-manager-master" (jasonfc888/corn-manager-master) from ClawHub.
Skill page: https://clawhub.ai/jasonfc888/corn-manager-master
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install corn-manager-master

ClawHub CLI

Package manager switcher

npx clawhub@latest install corn-manager-master
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (standardize OpenClaw cron creation/checks) matches the included scripts and CLI calls to openclaw cron. However, the SKILL.md promises automatic extraction of channel and user_id from session_status; the supplied scripts still contain TODO placeholders and default hard-coded values (CHANNEL="feishu", USER_ID="ou_xxxxxx"), so the claimed auto-extraction is not implemented. This mismatch between documentation and code is incoherent and may lead to unexpected behavior or require additional privileged access that the user wasn't warned about.
Instruction Scope
Runtime instructions tell the agent to call local OpenClaw CLI commands (openclaw cron add, openclaw cron list) and to parse their JSON output; that scope is appropriate for a cron-management skill. The SKILL.md directs automatic extraction from session_status output and storing logs/records in 'memory', but does not give the exact mechanism or safeguards. The validation script parses JSON output with grep/sed rather than robust JSON tools (jq is suggested in SKILL.md), which is brittle. Overall the instructions are not overly broad, but are vague about how session context is obtained and about what 'memory' persistence implies.
Install Mechanism
No install spec is provided (instruction-only plus shippped scripts). Nothing is downloaded or installed automatically by the skill, so install-time risk is low. The scripts are present and would run only when invoked.
Credentials
The skill declares no required environment variables, credentials, or config paths, and the scripts only call local openclaw CLI commands. There are no requests for unrelated secrets or external service tokens. That is proportional to a cron-management utility — but actual automatic extraction of session data (if implemented) may require agent-level access to session state that should be verified before use.
Persistence & Privilege
always:false and no code attempts to modify other skills or global agent configuration. The SKILL.md suggests recording logs/checks into 'memory' (presumably OpenClaw memory) but the provided scripts do not write persistent files other than standard output. There is no evidence of privilege escalation or permanent background processes.
What to consider before installing
This skill is plausible for managing OpenClaw cron tasks, but there are important inconsistencies to resolve before installing or using it in production: (1) SKILL.md claims automatic extraction of channel and user ID from session_status, but both scripts contain TODOs and hard-coded defaults — verify how session context will actually be provided and whether the agent/CLI has permission to read it. (2) Validation script parses JSON with grep/sed (fragile); prefer jq or robust JSON parsing to avoid false positives/negatives. (3) Ensure the OpenClaw CLI (openclaw) and any required gateway/status commands exist in your environment and that invoking them from this skill does not leak sensitive information. (4) Test the scripts in a safe environment with non-production user IDs and validate logging/where 'memory' entries go. If you rely on the promised auto-extraction, ask the author to provide the implementation or remove the misleading claim before deployment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a7zg3bg7kg7c7bkp6v6epen83nxjq
94downloads
1stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Skill: 定时任务创建通用技能 (Cron-Manager-Master)

📋 技能概述

本技能用于在 OpenClaw 系统中标准化、自动化地创建和检查定时任务。技能会智能提取当前对话的上下文信息(通道和用户 ID),实现零配置、无缝创建,确保所有任务符合系统规范。

🎯 触发条件

当识别到以下意图时触发本技能:

  • "创建定时任务"
  • "设置cron任务"
  • "openclaw cron"
  • "定时任务创建"

⚙️ 自动上下文提取(核心特性)

为极大地简化使用流程,本技能无需用户手动配置或记忆参数。 在每次触发创建定时任务时,技能会自动从当前会话中提取以下信息:

  1. 通道 (channel) - 从当前会话自动获取(如 feishuwecom 等)
  2. 用户ID (to) - 从当前会话自动获取(如 ou_xxxxxx

实现方式

  • session_status 命令输出中提取 channeluser_id
  • 当前会话示例:feishu:direct:ou_xxxxxx

📝 核心工作流

步骤 1:识别任务需求与目标

  • 明确任务名称、执行时间(一次性或周期性)、消息内容
  • 自动读取当前会话的 channeluser_id

步骤 2:执行创建命令

请严格使用以下命令格式,技能会自动填充当前会话的上下文:

一次性任务(指定具体时间)

openclaw cron add \
  --name "<任务名称>" \
  --at "<YYYY-MM-DDTHH:mm:ss+08:00>" \
  --session isolated \
  --message "<消息内容>" \
  --announce \
  --channel feishu \
  --to "ou_xxxxxx"

周期性任务

openclaw cron add \
  --name "<任务名称>" \
  --cron "<cron表达式>" \
  --session isolated \
  --message "<消息内容>" \
  --announce \
  --channel feishu \
  --to "ou_xxxxxx"

步骤 3:参数规范检查(创建前自检)

参数状态规范要求
--name✅ 必需任务名称,必须清晰明确
--at/--cron✅ 必需ISO 时间格式或标准 cron 表达式
--session isolated✅ 必需必须使用独立会话隔离执行环境
--message✅ 必需要发送的提醒或消息内容
--announce✅ 必需启用消息发送功能
--channel✅ 自动从当前会话自动获取通道值
--to✅ 自动从当前会话自动获取用户 ID 值

步骤 4:创建后系统验证

任务创建完成后,必须执行验证命令检查任务状态:

# 使用jq精确匹配任务名称
openclaw cron list --json | jq '.[] | select(.name == "<任务名称>")'

验证要点

  1. 检查 "sessionTarget": "isolated"
  2. 检查 "delivery": {"mode": "announce"}
  3. 检查 "channel": "feishu"(或其他正确通道)
  4. 检查 "to": "user:ou_xxxxxx"(格式正确)
  5. 检查时间格式正确(ISO 8601 UTC时间格式)

✅ 自动化规范检查清单

创建任务后,必须立即执行以下检查:

  • --session isolated参数 → 检查 "sessionTarget": "isolated"
  • --announce参数 → 检查 "delivery": {"mode": "announce"}
  • 指定了正确的--channel → 检查 "channel": "feishu"(或其他正确通道)
  • 包含用户ID → 检查 "to": "user:ou_xxxxxx"(格式正确)
  • 时间格式正确 → 检查 ISO 8601 UTC时间格式
  • 任务名称清晰明确 → 检查 "name""description"

🚨 错误处理与操作红线

核心红线

  • 严禁私自操作系统服务:如遇到 Gateway 连接失败或服务异常,必须先请求人工授权,禁止私自重启服务或变更底层配置
  • 承诺必须兑现:收到任务指令后必须实际创建自动化机制,不得仅作口头回复
  • Gateway重启必须确认:Gateway 重启是重要操作,必须让用户确认后再执行

监控与告警

  1. 执行前检查:重要任务需在执行前提前 30 分钟检查系统运行状态(包括脚本、目录和权限)
  2. 失败主动报告:如创建任务失败或定时任务执行超时(超过 5 分钟),需立即主动报告问题并提供备选方案(如询问是否立即手动执行)
  3. 日志记录:将所有的检查结果、操作记录或异常情况记入系统的 memory 或日志文件中以便复盘

错误处理示例

# 创建任务失败时的处理
if ! openclaw cron add ...; then
    echo "❌ 创建定时任务失败"
    echo "请检查:"
    echo "1. Gateway服务是否运行 (openclaw gateway status)"
    echo "2. 参数格式是否正确"
    echo "3. 是否有创建权限"
    exit 1
fi

📁 文件结构

cron-manager-master/
├── SKILL.md                    # 本文件
├── references/
│   └── cron-examples.md        # cron表达式示例参考
└── scripts/                    # (可选)辅助脚本

🔧 使用方法

  1. 直接调用技能:当检测到相关触发词时,技能会自动激活
  2. 手动创建任务:使用上述命令模板,替换 <任务名称><时间><消息内容>
  3. 参数说明
    • --name:任务名称(必需)
    • --at:一次性执行时间(ISO格式:YYYY-MM-DDTHH:mm:ss+08:00
    • --cron:周期性执行cron表达式
    • --message:要发送的消息内容(必需)
    • --session isolated:使用独立会话(必需)
    • --announce:启用消息发送(必需)
    • --channel:自动从当前会话获取
    • --to:自动从当前会话获取

📝 示例

示例1:创建明天上午9点的提醒

openclaw cron add \
  --name "明天会议提醒" \
  --at "2026-03-26T09:00:00+08:00" \
  --session isolated \
  --message "上午9点有团队会议,请准时参加" \
  --announce \
  --channel feishu \
  --to "ou_xxxxxx"

示例2:创建每天上午10点的日报

openclaw cron add \
  --name "每日AI新闻日报" \
  --cron "0 10 * * *" \
  --session isolated \
  --message "正在生成今日AI新闻日报..." \
  --announce \
  --channel feishu \
  --to "ou_xxxxxx"

Comments

Loading comments...