Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

scheduler for discord

v1.0.0

Create and manage scheduled reminders and posts. Use when the user asks Moltbot to send a message later or on a recurring schedule (especially to the current Discord channel) without requiring them to provide channel IDs.

0· 1.9k·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (schedule Discord messages) is reasonable, but the runtime instructions rely on a 'moltbot' CLI and access to Discord channel identifiers/config (metadata shows moltbot.requires.config: ["channels.discord"]). The published registry metadata lists no required binaries or config paths. The skill should have declared 'moltbot' as a required binary and the channels.discord config; the absence is an incoherence.
Instruction Scope
The SKILL.md stays within the scheduler remit (collect time, timezone, message, target) and explicitly instructs capturing channel IDs at creation time. That behavior is coherent for reliable delivery, but it does mean channel IDs (and scheduled message text) will be stored in cron jobs — a privacy/retention consideration the user should understand.
!
Install Mechanism
This is instruction-only (no install spec), which is low-risk in itself, but the instructions call out to an external binary via exec ('moltbot cron add'). Because the skill does not declare that dependency, the agent could fail at runtime or invoke an unexpected binary if present. The skill should explicitly declare required binaries and where they come from.
!
Credentials
The registry claims no required env vars or config paths, yet SKILL.md/metadata expect Discord channel context and a config key channels.discord. This mismatch is concerning: the skill implicitly requires access to messaging context/config that wasn't declared, and that should be made explicit. No secrets are requested, which is appropriate.
Persistence & Privilege
The skill creates scheduled, autonomous agent jobs (cron entries) that will run later and deliver messages. This is expected for a scheduler, but it increases blast radius because scheduled jobs can invoke the agent in the future. The skill does not request always:true, but users should review what the scheduled job will do and what data (channel IDs, message text) it will persist.
What to consider before installing
This skill appears to implement a reasonable scheduler, but it currently omits important declarations. Before installing: 1) Ask the author to declare required binaries (moltbot CLI) and required config (channels.discord) so you know what will be called and what will be read. 2) Verify the source and integrity of the moltbot CLI on your system (who provides it, where it's installed). 3) Understand that scheduled jobs will store channel IDs and message text and will run agent jobs later — review and approve what those jobs will execute. 4) Prefer a skill that explicitly documents dependencies and permissions (binaries, config paths, and where cron jobs are created). If you cannot verify those details, treat this skill cautiously or avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk970cnawaf4fnfnxm6dgqh6vp180c6t8
1.9kdownloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Scheduler (cron)

This skill schedules future actions using Moltbot’s cron CLI (via exec), defaulting to delivering the result back into the current Discord channel when available.

What to collect

  • When: either a one-shot time (in 2 minutes, at 20:00) or a recurring schedule (every day at 20:00).
  • Timezone: ask if ambiguous; otherwise prefer the gateway host’s timezone.
  • What: what the message should say, or what should be generated.
  • Where:
    • If the request came from Discord, use the message context’s channel id and set delivery target to channel:<id>.
    • If the request came from another surface (webchat/terminal), ask for a destination (Discord channel ID, Telegram chat ID, etc).

Key rules

  • Cron jobs run in the background, so there is no “current channel” at execution time. Always capture the channel id at creation time and bake it into the cron job (--channel discord --to channel:<id>).
  • Use an isolated agent job for scheduled messages (prevents the “Main jobs require --system-event” error).
  • Avoid ambiguous Discord names like #test; always deliver to an explicit channel:<id> or user:<id>.

Implementation (use exec)

One-shot message to the current Discord channel

If the user says “remind me in 2 minutes” (or similar), schedule a one-shot isolated agent job:

moltbot cron add \
  --name "<short-name>" \
  --session isolated \
  --at 2m \
  --agent main \
  --message "<message text>" \
  --deliver \
  --channel discord \
  --to channel:<DISCORD_CHANNEL_ID> \
  --delete-after-run

Notes:

  • --at accepts 2m, 20m, 1h, or an ISO timestamp. Do not use +2m.

Daily “tomorrow plan” at 20:00 (recurring)

If the user says “every day at 8pm, send me tomorrow’s work plan”, create a recurring cron job that instructs the agent to generate the plan and deliver it:

moltbot cron add \
  --name "tomorrow-plan" \
  --session isolated \
  --cron "0 20 * * *" \
  --tz "Asia/Shanghai" \
  --agent main \
  --message "At execution time, write tomorrow's work plan. Keep it concise. Include: priorities, schedule blocks, risks, and a short checklist." \
  --deliver \
  --channel discord \
  --to channel:<DISCORD_CHANNEL_ID>

Verify

moltbot cron list
moltbot cron runs --id <JOB_ID>

How to find the current Discord channel id

When the user request comes from Discord, the message context includes channel identifiers (e.g. channel=... / discord channel id ...). Use that value for channel:<id>.

If the context does not include it, ask the user to provide a Discord message link (from which you can extract the channel id), or the channel id directly.

Comments

Loading comments...