OpenClaw Timestamp Converter

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  2.0.0

Overview

This is a disclosed remote timestamp and timezone helper, with the main caveat that broad time-related prompts may be sent to its hosted service.

Install this if you want a hosted MCP helper for timestamp and timezone work. Avoid including confidential schedules, sensitive locations, or private meeting context in prompts unless you are comfortable sending that text to the configured remote endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The read_when triggers are broad enough to match many ordinary time-related prompts, which can cause the skill to activate more often than necessary and route user data to a remote MCP service. In a remote skill, overbroad activation increases unnecessary external data exposure and can crowd out more appropriate local or narrower tools.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The Detection Triggers section lists many broad example phrases but does not define boundaries for when the skill should not activate. Because this skill sends requests to a hosted endpoint, ambiguous activation can unnecessarily disclose user prompts and lead to tool misuse in contexts where no remote timestamp processing is needed.

VirusTotal

65/65 vendors flagged this skill as clean.