Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Travel Tracker

v1.0.0

管理和统计工作/生活外出记录,生成 Excel 报表,同步到 Obsidian。 Use when: 查询外出记录、统计外出次数、生成外出 Excel 报表、同步外出数据到 Obsidian、自动从日历提取外出、设置外出提醒。Triggers: "外出统计", "外出记录", "travel report", "...

0· 63·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for m646pxhjf4-dot/travel-tracker.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Travel Tracker" (m646pxhjf4-dot/travel-tracker) from ClawHub.
Skill page: https://clawhub.ai/m646pxhjf4-dot/travel-tracker
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install travel-tracker

ClawHub CLI

Package manager switcher

npx clawhub@latest install travel-tracker
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (manage travel records, generate Excel, sync to Obsidian, extract from calendar) aligns with the commands shown, but the skill provides no code or install step. It expects a specific set of local scripts in ~/.openclaw/workspace/scripts; that requirement is not documented in metadata and is unlikely to exist on a fresh system. This reliance on user-local scripts is surprising and makes the skill unusable without external files.
!
Instruction Scope
The SKILL.md instructs the agent to execute multiple absolute-path shell and Python scripts in the user's home (~/.openclaw/workspace/scripts/*). Those scripts (if present) could read/write calendars, files in ~/Documents/obsidiansave/, exports/, memory/, and perform arbitrary actions. The instructions do not include existence checks, safety constraints, or any indication of what data will be read/transmitted, nor do they describe how calendar access or Obsidian sync is performed.
Install Mechanism
There is no install spec (instruction-only). That reduces the risk of the skill adding files itself, but it also means the skill depends on external artifacts that are not provided. The absence of an install step is coherent with being instruction-only but amplifies the concern that running the skill will attempt to execute arbitrary local scripts.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However the instructions imply access to Apple Calendar and to the user's filesystem (Obsidian path, exports, memory). Those accesses are not declared or explained, so the skill will implicitly rely on the agent's ability to access local calendars and filesystems — this should be verified before use.
Persistence & Privilege
The skill does not request always:true or any special persistent privileges. It is user-invocable and will not be force-attached to all agents. No install-time writes are declared.
Scan Findings in Context
[no-findings] expected: The regex scanner found no code to analyze because this is an instruction-only skill (only SKILL.md). No automated findings to contextualize.
What to consider before installing
This skill will try to run a set of local scripts under ~/.openclaw/workspace/scripts and read/write files in ~/Documents/obsidiansave/, exports/, and memory/. Before installing or invoking it: (1) confirm those scripts actually exist and inspect their contents — do not run them if you don't trust them; (2) verify how calendar extraction works and whether it accesses your Apple Calendar API or local calendar files; (3) ensure the Obsidian path is correct and you are comfortable with files being written there; (4) if you want this skill to be safe, ask the publisher for the missing scripts or an install manifest, or run it in a sandboxed environment; (5) avoid invoking it with elevated privileges and consider backing up affected directories first.

Like a lobster shell, security has layers — review code before you run it.

latestvk976dm62n0913yrgmag6p9nep984n0rf
63downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Travel Tracker

统一管理外出记录(工作/生活分类)。

查询外出

# 查询外出记录
~/.openclaw/workspace/scripts/travel-query.sh [日期范围]

生成报表

# 每周外出统计
~/.openclaw/workspace/scripts/generate-weekly-travel-report.sh

# 月度 Excel(Python)
python3 ~/.openclaw/workspace/scripts/generate-travel-excel-2026-03.py

# 季度汇总
python3 ~/.openclaw/workspace/scripts/generate-travel-excel-2026-Q1.py

日历自动提取

# 从 Apple Calendar 提取外出安排
~/.openclaw/workspace/scripts/auto-travel-from-calendar.sh

同步到 Obsidian

~/.openclaw/workspace/scripts/sync-travel-to-obsidian.sh

外出提醒

# 自动验证并设置外出提醒
~/.openclaw/workspace/scripts/travel-reminder-auto-verify.sh

数据存储

  • 每周统计:memory/weekly-travel-YYYY-Www.md
  • Excel 报表:exports/
  • Obsidian:~/Documents/obsidiansave/外出记录/

分类规则

  • 工作外出:调研/考务/会议/拍摄等
  • 生活外出:购物/聚餐/办事等
  • 周报显示格式:工作 X 次 + 生活 X 次

Comments

Loading comments...