ClawHub

HalaOS HR Copilot

v2.1.0

AI HR Copilot for Southeast Asia. Works with HalaOS MCP Server for live data (employees, attendance, leave, payroll, compliance, org intelligence) or standal...

⭐ 0· 112·0 current·0 all-time
by@tonypk
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Requesting HALAOS_API_KEY and a local config path is consistent with a cloud-backed HR copilot. However there is a minor packaging inconsistency: SKILL.md expects ~/.openclaw/skills/halaos-hr-copilot/config.json while README.md references ~/.openclaw/skills/halaos-hr/config.json. Also the SKILL references a local MCP client binary (/usr/local/bin/halaos-mcp) but provides no install instructions for that binary.
ℹ
Instruction Scope
The runtime instructions stay within HR functionality (calling MCP tools, using local knowledge when no API key). They instruct storing local company configuration and optionally choosing storage targets (Notion/Google Sheets/Obsidian/local files). The skill does not instruct reading unrelated system files or exfiltrating data, but it may prompt the agent to interact with third-party storage services — those integrations would require additional credentials which are not declared here.
✓
Install Mechanism
This is an instruction-only skill with no install spec or bundled code, which is low-risk. The only install-related gap is that the MCP workflow references a vendor binary (/usr/local/bin/halaos-mcp) that the documentation expects to exist but does not provide or describe how to obtain.
✓
Credentials
Only HALAOS_API_KEY is required and declared as the primary credential — appropriate for connecting to a cloud HR platform. The SKILL.md also shows an optional HALAOS_BASE_URL in examples (not listed as required). There are mentions of third-party storage (Notion/Google Sheets) but no corresponding credential requirements declared; users should expect to provide separate credentials if they enable those storage integrations.
✓
Persistence & Privilege
The skill does not request elevated platform privileges and is not always-enabled. It asks to store its own config under the user's home (~/.openclaw/skills/...), which is standard for a per-skill configuration file and within expected scope.
Assessment
This skill appears coherent with its HR purpose, but review before enabling: only provide HALAOS_API_KEY if you trust the HalaOS service and understand what that key can do (scopes, data access). Verify where the key will be stored (MCP client configuration or the skill config file) and prefer adding it to trusted, local clients rather than pasting it into unknown UIs. Confirm the origin and install instructions for /usr/local/bin/halaos-mcp before creating an MCP entry. Be cautious about connecting third‑party storage (Notion/Google Sheets) — those will require additional credentials and could expose HR data. Note the README vs SKILL.md config path mismatch; ensure the skill writes config where you expect and lock file permissions. Rotate the API key immediately if you suspect accidental exposure.

Like a lobster shell, security has layers — review code before you run it.

latestvk970jxs7t6w275zafqyvpmzc4d83hptg

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvHALAOS_API_KEY
Config~/.openclaw/skills/halaos-hr-copilot/config.json
Primary envHALAOS_API_KEY

Comments