ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

timely

v1.0.0

Manage Apple Reminders from the command line with geofencing support. Use when creating reminders on macOS with optional location-based triggers (arrive/depa...

⭐ 0· 630·0 current·0 all-time
by@halbotley
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description, required binary ('timely'), and brew install from halbotley/tap are coherent for a macOS Reminders CLI with geofencing. OS restriction to darwin and requiring the 'timely' binary fit the stated purpose.
✓
Instruction Scope
SKILL.md instructs only to install and run the 'timely' CLI and explains command usage; it explicitly notes the one‑time Reminders permission prompt. It does not ask the agent to read unrelated files or environment variables. Note: geocoding and geofencing imply the CLI will access location/geocoding services and iCloud-synced Reminders data (expected for this functionality).
ℹ
Install Mechanism
Install uses Homebrew via a third‑party tap (halbotley/tap). Homebrew installs are common, but third‑party taps are less vetted than core formulas — the binary you install comes from that tap's source. Recommend reviewing the tap/formula before installing.
✓
Credentials
The skill declares no environment variables, no credentials, and no config paths. This is proportional to a local CLI that interacts with Reminders and geofencing.
✓
Persistence & Privilege
always is false and the skill does not request system‑wide persistent privileges beyond the normal one‑time macOS Reminders permission prompt. Be aware granting Reminders access (and iCloud sync) gives the installed CLI access to your Reminders data and shared lists.
Assessment
This skill appears to do what it says: install a macOS CLI that manages Reminders and sets location triggers. The main caution is the install source — it comes from a third‑party Homebrew tap (halbotley/tap). Before installing, inspect the formula/source for that tap (e.g., brew edit halbotley/tap/timely or view the tap repository) to confirm what will be downloaded and executed. Also be aware the CLI will require Reminders permission (and may perform geocoding/location checks and iCloud sync), so only grant access if you trust the publisher. If you want lower risk, look for the formula in an official tap or obtain source code you can review/build locally.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a9kybvmjvqg1pa2va62te19818jbe

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

⏰ Clawdis
OSmacOS
Binstimely

Install

Install timely (brew)
Bins: timely
brew install halbotley/tap/timely

Comments