ClawHub

TrueTime

v1.0.0

Ensure real-time accurate scheduling and planning across UTC, server time, NTP-sourced time, user local time, and arbitrary time zones. Use for timers, remin...

⭐ 2· 670·0 current·0 all-time
byYitao Jiang@cccat6
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill implements timezone conversions, calendar-aware arithmetic, lunar dates, and optional NTP-based time — all consistent with the TrueTime description. Minor mismatch: SKILL.md's runtime examples require running 'node {baseDir}/scripts/true_time.mjs' (and optionally piping to 'rg'), but the skill metadata does not declare any required binaries (e.g., node, rg). This is a usability/coherency issue (the runtime needs Node.js and optionally ripgrep) but not an indicator of malicious intent.
✓
Instruction Scope
SKILL.md confines actions to parsing time expressions, reading the runtime clock, converting timezones, and (optionally) querying NTP servers. It does not instruct reading arbitrary user files, environment variables, or sending data to unexpected endpoints. The only external network activity described is contacting public NTP servers for time, which matches the stated feature.
✓
Install Mechanism
There is no install specification and the script is bundled in the skill. Nothing is downloaded from external URLs; the script runs from the skill bundle. This is low-risk compared with remote download installers.
✓
Credentials
The skill does not request environment variables, credentials, or config paths. The only external access it needs is network UDP to public NTP servers when --time-source ntp is used; that is proportionate to the feature.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills or global configs. It runs only when invoked and does not require elevated or persistent privileges.
Assessment
This skill appears to do what it says: deterministic time math and optional NTP queries. Before installing, note two practical things: (1) the bundled script is intended to be invoked via 'node', but the skill metadata doesn't list 'node' as a required binary — ensure your agent runtime provides Node.js; (2) one example pipes output to 'rg' (ripgrep); that is optional but will fail if 'rg' is not available. The script will, by design, send UDP queries to public NTP servers when you request --time-source ntp; if your environment restricts outbound UDP or you have strict network policies, allow or avoid that option. No credentials are requested and no hidden external endpoints were detected in the provided files. If you want even higher assurance, review the full script (scripts/true_time.mjs) yourself to confirm there are no additional network calls or unexpected behaviors beyond NTP/time math.

Like a lobster shell, security has layers — review code before you run it.

latestvk97awcf18rbhjnzaqafaz2jde181a4mb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments