Niche Calendar

Provides schedules for WHL Saskatoon Blades, npm and ClawHub release timelines, Saskatoon events, and custom developer planning calendars.

Security Scan

The skill mostly matches its description, but its runtime instructions expect a local 'clawhub' CLI and allow proactive publish actions without declaring required binaries or asking for explicit consent — that mismatch and potential for side-effecting exec calls is concerning.

Purpose & Capability

The stated purpose (WHL schedules, npm/ClawHub timelines, local Saskatoon events, dev planning) aligns with using web_search/web_fetch and a ClawHub client. However, the SKILL.md explicitly calls exec "clawhub list"/"clawhub search"/suggests "clawhub publish" yet the skill metadata declares no required binaries or credentials — this inconsistency is unexplained.

Instruction Scope

Instructions direct the agent to run exec "clawhub ..." commands and to be 'Proactive' by suggesting or recommending publish steps. That grants the agent the ability to perform potentially destructive or authoritative actions (publishing skills) if the platform executes those execs autonomously. The instructions do not require confirmation or limit side effects.

Install Mechanism

This is an instruction-only skill with no install spec or code files, which minimizes disk-write/install risk.

Credentials

No environment variables or credentials are requested, which is reasonable. However, because the skill relies on a local 'clawhub' CLI, it may implicitly depend on local credentials/configurations for that tool — those are not declared or described.

Persistence & Privilege

always is false (good) but the skill is allowed autonomous invocation by default. Combined with instructions to exec 'clawhub publish' (or to be proactive about publishing), this raises the risk the agent could perform publish actions without explicit user confirmation unless the hosting platform enforces a consent step.

What to consider before installing

Before installing, be aware the skill expects to run local 'clawhub' commands but doesn't declare that binary as required. Ask: do you have the clawhub CLI installed and do you want the agent to be allowed to run it? If you permit the skill, require explicit confirmation before any exec that can publish or modify remote state (e.g., 'clawhub publish'). Prefer adding a declared required binary (clawhub) and an explicit instruction in SKILL.md that the agent must obtain user approval before running any publish or write operations. If you do not want the agent to run local CLIs or perform publishing, do not enable autonomous invocation for this skill or restrict its actions.

Triggers & Use Cases

• Sports: WHL Saskatoon Blades schedule, games, standings.
• Releases: NPM packages, ClawHub new/updated skills timelines.
• Events: Saskatoon/Clavet local (housing, hockey, dev meetups).
• Dev Planning: ClawHub skill version planning, publish timelines.

NOT for: general weather (weather skill), personal calendars (no caldav tool).

Workflow

1. Parse query: Identify type (sports/release/event/planning).
2. Gather data:
   • Sports: web_search "WHL Saskatoon Blades schedule {current_month} 2026 site:blades.ca" country="CA"
   • Releases NPM: web_search "{package} release schedule 2026"
   • ClawHub: exec "clawhub list", web_search "clawhub.com new skills"
   • Events: web_search "Saskatoon events {date range}" country="CA"
   • Planning: Suggest milestones (design/v1/test/publish).
3. Extract & format: Dates, descriptions, links. Use tables.
4. Enhance: Current date via session_status. Future-focused.

Example Outputs

Blades Schedule:

Date	Opponent	Time	Venue	Result/Link
2026-03-30	Regina Pats	7pm	SaskTel	tickets

ClawHub Recent:

• niche-email v1.0.0 (Mar 28)
• Upcoming: Check search "dev calendar"

Tools

• web_search + web_fetch primary.
• exec "clawhub search {term}" for ClawHub.
• session_status for date/time.

Proactive: If publish-related, suggest clawhub publish steps.