Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Steward Ops — World-Class AI Chief of Staff System
v1.0.0World-class autonomous admin, personal ops, chief-of-staff skill system. Use ANY time user asks to triage email, manage inbox, track deadlines, monitor renew...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to be a Chief-of-Staff ops system (triage email, track renewals, monitor platforms) but its instructions call out numerous external/local tools and paths (e.g., himalaya, agentreach in a user-specific virtualenv, openclaw cron) that are not declared in the metadata. The skill package declares no required binaries or credentials yet expects access to email inboxes, billing notices, platform sessions (Stripe, OpenAI, KDP, Etsy, etc.). This is disproportionate and suggests the skill was written for a specific user environment rather than a general-purpose skill.
Instruction Scope
SKILL.md and the reference files instruct the agent to run concrete shell commands and access specific local filesystem locations (for example: cd /Users/oliverhutchins1/.openclaw/... && .venv/bin/agentreach status, himalaya -a hutch list, openclaw cron list). They also mandate aggressive triggering and broad data collection (triage across accounts, billing/emails, session statuses). Those instructions go beyond passive guidance and direct the agent to interact with local tools, user-specific workspaces, and account data — actions that can access sensitive secrets or PII. The instructions are not limited by declared requirements, and the agent is given broad discretion ('Trigger aggressively'), which increases risk.
Install Mechanism
There is no install spec and no code files beyond instruction/reference docs (instruction-only), which lowers risk from arbitrary remote code installation. However, the runtime instructions rely on many external CLIs and a project virtualenv. The lack of an install step means the skill assumes those binaries and environments already exist; that assumption is undocumented and fragile, and could cause the agent to attempt commands that fail or behave unpredictably.
Credentials
The skill metadata declares no required environment variables or credentials, but the content repeatedly references services that normally require credentials (OpenAI, Anthropic, Stripe, Google/Google Workspace, Etsy, KDP, Reddit, AgentReach, etc.) and expects the agent to check billing emails and sessions. Asking the agent to monitor or act on these resources without declaring or describing the necessary credentials is incoherent. The references to a specific user home directory further imply access to that user's credentials/configs (e.g., .openclaw workspace), which is disproportionate to a generic skill and may expose other agents' or users' secrets if executed.
Persistence & Privilege
The skill is not marked always:true (good) but its operational mandate is broad and 'auto' Tier 1 behaviors are encouraged (aggressive triggering, automatic daily briefs, session renewals when AgentReach handles it). Because it directs local commands and workspace inspection, an autonomously-invoked agent using this skill could read local state and run tools on the host. That combination — autonomy + instructions that touch user-specific filesystem and account tooling — increases the blast radius and warrants caution.
What to consider before installing
This skill is 'suspicious' because its instructions expect many local CLIs, a specific user's home-path workspace, and access to platform/account data, yet the registry declares no required binaries or credentials. Before installing or enabling it, consider: 1) Ask the author for clarification: what binaries and credentials are required, and why are there user-specific paths? 2) Do not run it with autopilot/autonomous invocation until you verify it — test in an isolated sandbox container or VM that has no access to your real accounts or home directory. 3) If you want similar functionality, prefer skills that explicitly declare required binaries and credentials (and limit them to the minimum necessary), or provide credentials with least privilege and separate test accounts. 4) Inspect and, if possible, audit any runtime commands the skill would run; remove or adapt hard-coded absolute paths. 5) If you lack confidence in the author or cannot sandbox, do not enable the skill for autonomous use and avoid granting access to production credentials or personal email accounts.Like a lobster shell, security has layers — review code before you run it.
adminvk97ab05rdh7vrxg74f65m0xxbx83b9nyautomationvk97ab05rdh7vrxg74f65m0xxbx83b9nycalendarvk97ab05rdh7vrxg74f65m0xxbx83b9nychief-of-staffvk97ab05rdh7vrxg74f65m0xxbx83b9nyinboxvk97ab05rdh7vrxg74f65m0xxbx83b9nylatestvk97ab05rdh7vrxg74f65m0xxbx83b9nyopsvk97ab05rdh7vrxg74f65m0xxbx83b9nyproductivityvk97ab05rdh7vrxg74f65m0xxbx83b9nyremindersvk97ab05rdh7vrxg74f65m0xxbx83b9ny
License
MIT-0
Free to use, modify, and redistribute. No attribution required.