Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Productivity Helper #5
v1.0.0Productivity helper tool #5 for task management, time tracking, and workflow optimization. Helps organize daily tasks and boost efficiency.
⭐ 0· 0·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description (task management, time tracking) match the minimal instructions in SKILL.md. However, the README suggests installing a GitHub repo (git clone) and a ClawHub install command whose slug differs from the registry slug, which is not accounted for in the package metadata — this mismatch is unexpected for an instruction-only skill.
Instruction Scope
SKILL.md itself is very high-level and does not instruct the agent to read system files or environment variables. But it includes an external setup link (https://skillboss.co/skill.md) and the README gives explicit shell install steps (git clone, cp into ~/.openclaw/skills). Those external instructions could lead the user/agent to fetch and execute code not present in the skill bundle.
Install Mechanism
The skill has no formal install spec in the registry, but README/manual instructions recommend cloning a GitHub repository and copying it into the user's skills folder. That implies executing or writing external code from an external repo despite the package itself being instruction-only, which increases risk — especially because the repository referenced is not packaged or reviewed as part of this skill.
Credentials
The skill declares no required environment variables, credentials, or config paths. That is proportionate to the stated purpose. That said, allowed-tools include Bash/Read/Write, which would allow file access if the agent follows external install steps; the metadata does not request secrets directly.
Persistence & Privilege
always:false and no special privileges are requested. The skill does not request to be force-enabled or to modify other skills. The main persistence concern is the README's suggestion to copy files into ~/.openclaw/skills, which would store external code on disk — a user action rather than an automatic behavior of the packaged skill.
What to consider before installing
This skill itself is just a short instruction file and doesn't ask for credentials, but exercise caution because the README and setup link point to external resources. Before installing or running it: (1) verify the external GitHub repository and the author are trustworthy and inspect the repository contents yourself (look for network calls, scripts that run on install, and any obfuscated code); (2) do not run clone/copy commands as root or without reviewing the code; (3) avoid granting the agent Bash/Read/Write access to sensitive directories unless necessary; (4) prefer skills that include an install spec or bundled code in the registry so you can review what will be executed; and (5) if you’re unsure, test the repository in an isolated sandbox or ask the publisher for source verification before using it in production.Like a lobster shell, security has layers — review code before you run it.
automationvk97d3svwpc51t752khgxqt261x84rsaxlatestvk97d3svwpc51t752khgxqt261x84rsaxproductivityvk97d3svwpc51t752khgxqt261x84rsaxtasksvk97d3svwpc51t752khgxqt261x84rsaxworkflowvk97d3svwpc51t752khgxqt261x84rsax
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚡ Clawdis