Hackathon Manager

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent hackathon tracker, with the main thing to notice being optional Google Calendar sync/delete through an authenticated external CLI.

This appears reasonable for tracking hackathons. Before using Google Calendar features, verify the `gog` CLI is trusted and authenticated to the right account, and review any sync or remove action because it can change calendar events.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used, the skill can add or remove events from Google Calendar.

Why it was flagged

The documented calendar commands can create and delete external account data. This is disclosed and user-directed, but users should review before using sync or remove.

Skill content
Create Google Calendar events for all tracked hackathons ... Delete all calendar events matching the hackathon name.
Recommendation

Run calendar sync/remove only when intended, and review the target hackathon name before deleting events.

What this means

Calendar commands will use whichever Google account the local `gog` CLI is authenticated with.

Why it was flagged

The optional integration acts through an authenticated Google Calendar CLI. The artifacts do not show hardcoded, logged, or exfiltrated credentials, but it does use delegated account access.

Skill content
Sync hackathons to Google Calendar using the gog CLI. Requires [gog](https://github.com/rubiojr/gog) to be installed and authenticated.
Recommendation

Confirm `gog` is authenticated to the intended account and has permissions you are comfortable granting.

What this means

Using the calendar feature depends on the safety of the locally installed `gog` binary.

Why it was flagged

The calendar feature depends on an external CLI outside the supplied artifacts. It is not auto-installed here, but users must trust and maintain that separate tool.

Skill content
Google Calendar integration requires [gog CLI](https://github.com/rubiojr/gog)
Recommendation

Install `gog` only from a trusted source and keep it updated.

What this means

Hackathon names, deadlines, prizes, and checklist items remain on disk until removed.

Why it was flagged

The skill keeps persistent local task data. This is disclosed and purpose-aligned, but the stored checklist/deadline content may be reused in later interactions.

Skill content
Hackathons stored in JSON at: `~/.openclaw/workspace/hackathons.json`
Recommendation

Avoid storing confidential submission details if unnecessary, and delete the JSON file if you want to reset the tracker.