ClawHub

temporal-cortex

v0.9.1

Schedule meetings, check availability, and manage calendars across Google, Outlook, and CalDAV. Routes to focused sub-skills for datetime resolution and cale...

⭐ 1· 749·3 current·3 all-time
byBilly Lui@billylui
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the declared requirements: it needs npx to install an MCP server binary and configuration files for OAuth tokens (~/.config/temporal-cortex/*). Those items are appropriate for a calendar scheduling router that performs OAuth-based calendar operations.
ℹ
Instruction Scope
SKILL.md describes routing to sub-skills, a local MCP server, safety rules (confirm before booking), and that credentials are stored under ~/.config/temporal-cortex. It does not instruct the agent to read unrelated files or environment variables. Note: the documentation asserts a 'Local Mode (default): No calls to Temporal Cortex servers. No telemetry.' That behavior depends on the installed MCP binary; the skill text alone cannot prove the binary's runtime network behavior.
ℹ
Install Mechanism
Install is via an npm package (@temporal-cortex/cortex-mcp) which produces a cortex-mcp binary. npm packages are a common distribution method but can contain arbitrary native code or bundled binaries; this is a moderate-risk install mechanism and reasonable for this use-case, but you should verify the package and its build artifacts (or prefer a signed/reproducible release).
✓
Credentials
No environment variables or unrelated credentials are requested. Storing OAuth tokens in ~/.config/temporal-cortex/credentials.json is consistent with calendar integrations. The set of required config paths is proportional to the stated purpose.
✓
Persistence & Privilege
The skill is not forced always-on (always:false). It can be invoked autonomously (platform default), which is expected for skills that can act (and the SKILL.md includes a 'confirm before booking' rule). It does not request system-wide modifications or other skills' credentials.
Assessment
This skill appears coherent for calendar routing, but before installing: (1) inspect the npm package @temporal-cortex/cortex-mcp and the referenced GitHub repo to confirm the binary's source and build artifacts match the documentation; (2) verify the binary's network behavior (prefer running it in a container or sandbox and monitor outbound connections) to confirm the 'Local Mode / no telemetry' claim; (3) review how OAuth tokens are created and stored in ~/.config/temporal-cortex/credentials.json and ensure file permissions are restrictive; (4) ensure the agent/platform will honor the SKILL.md safety rules (prompting you to confirm bookings) before allowing autonomous booking actions. If you cannot verify the binary/source, treat it as higher risk and avoid granting it access to real calendars.

Like a lobster shell, security has layers — review code before you run it.

latestvk97av33s76gjj5vg38wjxsqkzd82nws6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsnpx
Config~/.config/temporal-cortex/credentials.json, ~/.config/temporal-cortex/config.json

Install

Node
Bins: cortex-mcp
npm i -g @temporal-cortex/cortex-mcp@0.9.1

Comments