Key Expiry Tracker

• Risk level: Low
• Analyzed: Feb 17, 2026, 3:07 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's files and runtime instructions are coherent with its stated purpose (tracking expiry timestamps stored in a local JSON file) and do not request credentials or network access; minor metadata inconsistencies are present but not malicious.

This skill appears to do what it claims: check expiry timestamps from a local JSON and alert via exit codes/console output. Before installing, verify the following: 1) inspect and create ~/.openclaw/workspace/.credentials.json yourself and ensure it contains no secret values (only names and ISO expiry timestamps); 2) confirm jq and bash are available on your system (METADATA.json requires them); 3) restrict the credentials file permissions (chmod 600) so only you can read it; 4) run the script manually once to confirm behavior and date parsing on your OS (GNU date vs BSD date differences can break parsing); 5) be aware the package requests filesystem permission in metadata so it can read the workspace file and can be scheduled by cron. The mismatches between the top-level registry summary (no required binaries/config paths) and METADATA.json look like packaging oversights — nothing malicious, but you should correct or confirm metadata before wider deployment.