WhatPulse AI Agent Skill
v1.0.0Query WhatPulse computer usage statistics using natural language. Keystrokes, mouse activity, application screen time, network bandwidth, website tracking, u...
⭐ 0· 274·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the instructions: the skill only needs to read a local WhatPulse SQLite database and requires the sqlite3 CLI. Requiring sqlite3 is proportional and expected for this purpose.
Instruction Scope
SKILL.md explicitly instructs the agent to run sqlite3 in read-only mode and to return answers based on queries of the local DB — that stays within the stated purpose. However the README and SKILL.md include a 'Remote Access' section that instructs users how to snapshot/sync the DB to remote machines. That guidance encourages moving highly sensitive telemetry (keystrokes, websites, app usage) off the local machine, which increases risk. The SKILL.md also references environment variables (WHATPULSE_DB, LOCALAPPDATA, HOME) for locating the DB; WHATPULSE_DB is optional but referenced even though the registry metadata lists no env vars.
Install Mechanism
This is instruction-only with no install spec or code to download or execute beyond invoking the sqlite3 CLI. That is the lowest-risk install model and is proportionate for the described functionality.
Credentials
Registry metadata declares no required env vars, yet SKILL.md uses WHATPULSE_DB as an optional override and also references LOCALAPPDATA and HOME. The optional WHATPULSE_DB can be used to point the agent at a synced/remote DB; if a user sets this to a remote-mounted path or exposes a snapshot, the agent (especially if running remotely) can access all telemetry. No other unrelated credentials are requested, but the documentation’s instructions to create scheduled backups and sync via cloud storage materially increases the scope of data exposure.
Persistence & Privilege
always is false and there is no installation script that modifies agent-wide settings or other skills. The skill runs only when invoked and doesn't request elevated or persistent platform privileges.
What to consider before installing
This skill will read your WhatPulse database and can reveal very sensitive personal telemetry (keystrokes, websites visited, app usage, uptime). Before installing: (1) Review SKILL.md so you understand what SQL queries the agent will run and ensure sqlite3 is present. (2) Do NOT set WHATPULSE_DB to a path that exposes your DB to remote machines or cloud storage unless you explicitly want that data off your device — the README’s 'Remote Access' instructions can lead to accidental data exfiltration. (3) If you run the agent on a remote host, expect the agent to be able to read the full DB at the path you expose. (4) Consider running the skill only locally or with a sanitized/cropped snapshot of the DB if you want to limit exposure. (5) Note the minor metadata mismatch: WHATPULSE_DB is used by the skill but not declared in the registry; treat that as an informational gap and verify env usage before trusting the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk974npgcmfjq91yczsxtqy7141823xad
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
keyboard Clawdis
OSmacOS · Linux · Windows
Binssqlite3