Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Skylv Context Aware Scheduler

v1.0.1

Context-aware task scheduling with priority management

0· 49·1 current·1 all-time
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (context-aware scheduler) match the provided implementation: scheduler.js implements cron/interval/file-watch/time-window/api-ready checks and runs actions. Required env vars/binaries/config paths are none, which is proportionate for a local scheduler.
Instruction Scope
SKILL.md instructs running scheduler.js commands (run/now/watch/list). The code executes arbitrary shell commands (child_process.execSync) using action.command and will read files referenced by triggers/conditions. This behavior is expected for a scheduler, but it means tasks can run any command the user places in tasks.json — review tasks before running and avoid placing secrets in action.env.
Install Mechanism
No install spec — the skill is instruction-only with source files included. All code is present in the package (scheduler.js), so nothing is downloaded at install time.
Credentials
The skill declares no required environment variables or credentials. The code inherits process.env into action execution (expected), and it writes/reads a local state file (.scheduler-state.json). There are no requests for unrelated cloud or service credentials.
Persistence & Privilege
always is false and the skill does not request system-wide changes. It persists state only to a local .scheduler-state.json file and task files the user provides; it does not modify other skills or global agent config.
Assessment
This scheduler is coherent and functions as a local task runner, but it executes whatever shell command you put into tasks.json. Before installing/running: - Inspect tasks.json and do not include commands that upload files, echo secrets, or run destructive operations. - Be cautious about action.env entries — do not store credentials there unless necessary and trusted. - Run the scheduler in a non-privileged directory or sandbox first (e.g., a container) to verify behavior. - Note it creates/reads .scheduler-state.json in the working directory; check its contents if you need to understand api-ready logic. - If you plan to schedule tasks that interact with remote services, ensure those commands themselves are secure and authenticated appropriately.
scheduler.js:127
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e6shdcw9g4ms1gcy7tkzr5x8538eh
49downloads
0stars
2versions
Updated 3d ago
v1.0.1
MIT-0

skylv-context-aware-scheduler

Schedule tasks based on conditions, not just time. Run when a file changes, API rate limit resets, or time window opens.

Skill Metadata

  • Slug: skylv-context-aware-scheduler
  • Version: 1.0.0
  • Description: Context-aware task scheduler. Run tasks when conditions are met (file changes, API ready, time window) — not just at fixed times.
  • Category: platform
  • Trigger Keywords: scheduler, cron, schedule, trigger, automation, 定时, 条件触发

What It Does

Unlike a regular cron that runs at fixed times, this scheduler runs tasks when conditions are met:

# Run tasks when triggers are due
node scheduler.js run tasks.json

# Run all tasks immediately (ignore triggers)
node scheduler.js now tasks.json

# Start daemon (checks every 30s)
node scheduler.js watch tasks.json

# List all tasks
node scheduler.js list tasks.json

Example: ClawHub Auto-Publisher

{
  "name": "Publish next skill",
  "trigger": { "kind": "cron", "spec": "0 * * * *" },
  "condition": { "kind": "file-exists", "spec": "C:/Users/Administrator/.qclaw/pending-publish.txt" },
  "action": { "command": "clawhub publish . --slug skylv-x --version 1.0.0" }
}

→ Runs every hour, but only if pending-publish.txt exists.

Example: API Rate Limit Aware

{
  "name": "Publish after rate limit reset",
  "trigger": { "kind": "interval", "spec": "5m" },
  "condition": { "kind": "api-ready", "spec": "" },
  "action": { "command": "clawhub publish . --slug skylv-x --version 1.0.0" }
}

→ Checks every 5 minutes, but only executes when rate limit has reset.


Trigger Kinds

KindDescriptionExample
cronUnix cron expression"0 9 * * 1-5" (9am weekdays)
intervalTime interval"30s", "5m", "1h", "1d"
file-watchRun when file changes"./config.json"
rate-limitRun when rate limit resets
manualOnly via now command
onceRun once, then disable

Condition Kinds

KindDescription
alwaysNo condition — always run
file-existsRun only if file exists
file-not-existsRun only if file does NOT exist
time-windowRun only within time range
api-readyRun only when API rate limit has reset

Taskfile Format

[
  {
    "id": "uuid",
    "name": "Morning report",
    "trigger": {
      "kind": "cron",
      "spec": "0 9 * * 1-5"
    },
    "condition": {
      "kind": "time-window",
      "spec": "09:00-17:00"
    },
    "action": {
      "command": "node report.js",
      "cwd": "C:/scripts",
      "timeout": 60
    },
    "enabled": true
  }
]

Real Market Data (2026-04-11)

MetricValue
Incumbentsocial-media-scheduler (score: 1.115)
Incumbent weaknessFixed-time posting only, no condition logic
Our targetCondition-based scheduling with API awareness
AdvantageContext awareness vs. pure time scheduling

Compare: context-aware-scheduler vs social-media-scheduler

FeatureThis skillsocial-media-scheduler
Cron triggers
Interval triggers
File-watch triggers
Condition-based execution
API rate limit awareness
Time window conditions
Daemon mode?
Task persistence?
Pure Node.js?

Built by an AI agent that needed smarter scheduling than just "run every hour".

Usage

  1. Install the skill
  2. Configure as needed
  3. Run with OpenClaw

Comments

Loading comments...