Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Supervisor

v1.1.1

Central status dashboard for the PA agent. Use when: owner asks 'what's the status', 'what are you working on', 'what's happening', or any status/overview qu...

1· 147·3 current·3 all-time
byNetanel Abergel@netanel-abergel

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for netanel-abergel/supervisor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Supervisor" (netanel-abergel/supervisor) from ClawHub.
Skill page: https://clawhub.ai/netanel-abergel/supervisor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install supervisor

ClawHub CLI

Package manager switcher

npx clawhub@latest install supervisor
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose — building a status dashboard — aligns with the actions in SKILL.md (reading task files, group contexts, billing JSON, and reporting system health). However, the instructions also perform operations that require external-network checks (curl to Anthropi c API) and git inspection; these capabilities are reasonable for system-health items but are not declared in the skill metadata.
!
Instruction Scope
Runtime instructions read many files under $HOME/.openclaw/workspace (daily notes, whatsapp DMs, group context and metadata) and use grep, python3, curl, and git. The skill also contains a 'close-the-loop' rule that requires contacting people directly and reporting back — this implies outbound communication but does not specify the channel or authorization. The instructions access private conversation data and may initiate external communication, which is broader than a passive dashboard and should be explicit in metadata/consent.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This is the lowest-risk install mechanism.
!
Credentials
The SKILL.md references an environment variable (ANTHROPIC_API_KEY) when calling an external API, but the skill metadata lists no required environment variables or primary credential. The script also implicitly depends on binaries (grep, python3, curl, git) that metadata doesn't declare. Asking to read WhatsApp DM files and other private files is proportionate to a dashboard only if the user knowingly grants file access; the metadata does not surface these needs.
Persistence & Privilege
The skill is not always-enabled and does not request special platform privileges. It instructs updating local tracking files (tasks.md, billing-status.json, whatsapp memory) which is expected for its function. However, combined with the instruction to contact people directly and the agent's default ability to invoke skills autonomously, this could result in outbound messages or actions if integration for messaging exists — the SKILL.md does not clarify safeguards.
What to consider before installing
This skill mostly does what a 'supervisor' should — read your workspace and produce a report — but there are some gaps you should address before installing: - Confirm and consent to file access: it reads $HOME/.openclaw/workspace, including WhatsApp DM and group files. Only install if you are comfortable granting the agent access to those private messages and notes. - Expect required tools and a secret: the instructions call grep, python3, curl, and git, and they use ANTHROPIC_API_KEY for an API check. The registry metadata does not declare these. If you install, ensure those binaries are available and consider whether you want to provide an API key; avoid supplying keys you don't trust the skill with. - Clarify outbound actions: the skill tells the agent to 'contact that person directly' for follow-ups but doesn't define how. Decide whether the agent should be allowed to send messages on your behalf and, if so, which channel and with what safeguards. - Ask the author (or maintainer) to update metadata: they should declare required binaries and env vars, and explicitly describe any outbound communication behavior. If you cannot obtain those clarifications, treat the skill as risky and avoid enabling it for sensitive accounts or data.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bz3q28rvvk936pcgd0017p9842s4y
147downloads
1stars
3versions
Updated 3w ago
v1.1.1
MIT-0

Supervisor Skill

The single source of truth for what the agent is currently tracking.


When to Use

Trigger phrases:

  • "מה הסטטוס" / "what's the status"
  • "מה קורה" / "what's going on"
  • "תתני לי סיכום" / "give me a summary"
  • "על מה את עובדת" / "what are you working on"
  • "supervisor"

Status Report Format

Always structure the report by category. Only include categories with active items.

📊 Status Report — [DATE TIME]

🔴 URGENT / BLOCKING
• [issue] — [who is affected] — [what's needed]

🟡 IN PROGRESS
• [task] — [status] — [next step]

⚠️ OPEN ISSUES
• [issue] — [group/person] — [since when]

👥 GROUP ACTIVITY
• [Group Name]: [last significant event]

📬 PENDING FOLLOW-UPS
• [person] — [what you're waiting for]

✅ COMPLETED TODAY
• [task] — [outcome]

🔧 SYSTEM HEALTH
• Model: [current model]
• WhatsApp: [connected/disconnected]
• API Billing: [OK / issue with which PAs]
• Last backup: [time]

Data Sources

The supervisor reads from these files to build the report:

build_status_report() {
  WORKSPACE="$HOME/.openclaw/workspace"
  TODAY=$(date -u +%Y-%m-%d)
  
  echo "📊 Status Report — $(date -u '+%Y-%m-%d %H:%M UTC')"
  echo ""

  # Open tasks / blockers from daily notes
  echo "🔴 URGENT / BLOCKING"
  grep -i "blocked\|urgent\|waiting\|מחכה\|חסום" \
    "$WORKSPACE/memory/$TODAY.md" 2>/dev/null | tail -5
  echo ""

  # Pending follow-ups from DM memory
  echo "📬 PENDING FOLLOW-UPS"
  grep -r "follow.up\|pending\|לעקוב\|להחזיר" \
    "$WORKSPACE/memory/whatsapp/dms/" 2>/dev/null \
    --include="*.md" | grep "$(date +%Y-%m)" | tail -5
  echo ""

  # Group highlights
  echo "👥 GROUP ACTIVITY"
  for group_dir in "$WORKSPACE/memory/whatsapp/groups"/*/; do
    [ -d "$group_dir" ] || continue
    NAME=$(python3 -c "import json; print(json.load(open('${group_dir}meta.json')).get('name','?'))" 2>/dev/null)
    LAST=$(tail -1 "${group_dir}context.md" 2>/dev/null)
    [ -n "$LAST" ] && echo "• $NAME: $LAST"
  done
  echo ""

  # System health
  echo "🔧 SYSTEM HEALTH"
  
  # API billing check
  API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "x-api-key: ${ANTHROPIC_API_KEY:-none}" \
    -H "anthropic-version: 2023-06-01" \
    https://api.anthropic.com/v1/models 2>/dev/null)
  case "$API_STATUS" in
    200) echo "• Billing: ✅ OK" ;;
    402) echo "• Billing: ⚠️ OUT OF CREDITS" ;;
    401) echo "• Billing: ❌ Invalid API key" ;;
    *)   echo "• Billing: ? ($API_STATUS)" ;;
  esac
  
  # Last git backup
  LAST_COMMIT=$(git -C "$WORKSPACE" log -1 --format="%ar" 2>/dev/null)
  echo "• Last backup: $LAST_COMMIT"
}

Tracked Categories

Tasks

Store active tasks in memory/tasks.md:

## Active Tasks
- [ ] [task description] | owner: [person] | since: [date] | next: [action]
- [x] [completed task] | done: [date]

Update this file whenever a task starts, progresses, or completes.

Billing Status

Store known billing issues in memory/billing-status.json:

{
  "last_checked": "2026-04-01T10:00:00Z",
  "issues": [
    {"pa": "Aria", "owner": "Jane Smith", "since": "YYYY-MM-DD", "status": "out_of_credits"},
    {"pa": "Rex", "owner": "John Doe", "since": "YYYY-MM-DD", "status": "resolved"}
  ]
}

Groups

For each WhatsApp group in memory/whatsapp/groups/, the supervisor shows:

  • Group name
  • Last logged event
  • Any open decisions or pending actions

Pending Follow-ups

Log these in the relevant DM memory file when you're waiting on someone:

[YYYY-MM-DD HH:MM] WAITING: Calendar access fix from [Owner Name]

Close-the-loop rule: When the owner asks you to check on someone, your job is:

  1. Contact that person directly
  2. Report back to the owner what they said

❌ Do NOT ask the owner instead of the person ❌ Do NOT swallow the answer — the owner asked because they want to know ✅ Always report back, even if the answer is "no update yet"


Quick Status (Short Version)

If owner just wants a quick overview:

📊 Quick Status — [TIME]

🔴 Blocking: [count] items
🟡 In Progress: [count] tasks  
⚠️ Open Issues: [count]
💡 Top item: [most important thing right now]

Say "full status" for details.

Updating the Status

After completing any significant action, update the relevant tracking file:

ActionUpdate
Task completedMark [x] in tasks.md
Billing error resolvedUpdate billing-status.json
Group decision madeLog to group's decisions.md
Owner confirmed somethingLog to DM notes.md
Follow-up receivedRemove from pending, log outcome

Cost Tips

  • Cheap: Reading files and formatting the report — any small model
  • Expensive: Summarizing many long files — batch the reads, summarize per file not all at once
  • Avoid: Calling external APIs for status checks every time — cache results for 15+ minutes
  • Batch: Build the full report in one pass, don't call build_status_report multiple times

Minimum Model

Any model that can:

  1. Read files
  2. Follow a template
  3. Fill in blanks from file content

No reasoning required. No external API calls needed for basic status. Use a larger model only if summarizing very long conversation histories.


Integration

  • After each task → update tasks.md
  • After each group message → update whatsapp-memory
  • On billing error → update billing-status.json
  • On heartbeat → run quick status check, alert if anything urgent
  • On "supervisor" → run full build_status_report and send to owner

Scope Rules

Always check who is asking and from where before generating the status report:

ContextScope
DM from ownerFull report — all tasks, all groups, all issues, system health
Group messageFilter to THIS GROUP ONLY — topics, decisions, open items from this group
DM from someone elseFilter to items relevant to this person only

Never send the full supervisor report in a group.

Example — if asked in the PA Team group:

📊 PA Team Status — [date]
• PA Operating Standard: sent and acknowledged by most PAs ✅
• Open: [PA Name] calendar write access — pending [Owner]'s response
• Open: [PA Name] calendar access — awaiting gog error output

Example — if asked in a DM from owner: → Full report (all categories)


PA Network Health (Merged from pa-status skill)

Use this section to check the health of all PA agents in the network. Reads from data/pa-directory.json.

Status Checks (per PA)

CheckFieldHealthy State
Last activelast_seenWithin 24 hours
Billingbilling_errorfalse
Calendarcalendar_connectedtrue
Statusstatus"active"

Network Report Script

#!/usr/bin/env python3
import json, datetime

try:
    with open('data/pa-directory.json') as f:
        d = json.load(f)
except FileNotFoundError:
    print("ERROR: data/pa-directory.json not found"); exit(1)

today = datetime.date.today().isoformat()
online, issues, offline = [], [], []

for pa in d.get('pas', []):
    name, owner = pa['name'], pa['owner']
    status = pa.get('status', 'unknown')
    model = pa.get('model', 'unknown')
    calendar = "✅" if pa.get('calendar_connected') else "❌"
    billing_ok = not pa.get('billing_error', False)

    if status == 'active' and billing_ok:
        online.append(f"• {name} ({owner}) — {model}, cal {calendar}")
    elif status == 'inactive':
        offline.append(f"• {name} ({owner})")
    else:
        billing = "✅" if billing_ok else "⚠️ billing error"
        issues.append(f"• {name} ({owner}) — {billing}")

total = len(d.get('pas', []))
print(f"📊 PA Network Status — {today}\n")
print(f"✅ ONLINE ({len(online)}/{total})")
for line in online: print(line)
if issues:
    print("\n⚠️ ISSUES")
    for line in issues: print(line)
if offline:
    print("\n❌ OFFLINE")
    for line in offline: print(line)
if not issues and not offline:
    print("\nAll PAs are healthy 🎉")

Quick Ping (Reachability)

Only ping PAs flagged with issues (not healthy ones — avoids noise):

For each PA in issues list:
  Send: "ping 🏓" → wait up to 5 minutes
  Response received → ONLINE
  No response → check whatsapp-diagnostics section + billing-monitor skill

Schedule

  • Daily at 09:00 — Full network report to admin
  • On billing error — Immediate partial report for affected PA
  • On demand — When admin asks "what's the status?"

Comments

Loading comments...