OpenClaw Timestamp Converter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:04 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent timestamp and timezone tool, but it relies on an unverified remote MCP service and broad activation rules that may send time or scheduling details outside the user's environment.

Install only if you are comfortable sending timestamps, meeting times, timezone queries, and date calculations to the listed third-party MCP endpoint. Avoid using it for confidential schedules or sensitive business timing unless you trust the operator and accept that the remote implementation was not independently verifiable from this package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unaudited Mutable Remote MCP Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-48
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

markdown

## Quick Start

```json
{
  "openclaw-timestamp": {
    "type": "streamable-http",
    "url": "https://timestamp-converter-mcp.yagami8095.workers.dev/mcp"
  }
}

Add to Claude Desktop, Cursor, Windsurf, VS Code, or any MCP-compatible client. Zero install. Works immediately.

text

### Technical Analysis

The skill directs users to configure a remotely hosted MCP server on a mutable Cloudflare Workers subdomain. The package contains no server implementation, pinned source revision, artifact digest, signature, or other integrity mechanism that would allow users to verify the behavior of the service. Consequently, the server operator can alter the effective tool implementation after this skill has been reviewed or installed.

All values submitted to the advertised tools, including timestamps, meeting times, source and destination time zones, and date calculations, are transmitted to infrastructure controlled by a third party. The privacy claims in `SKILL.md`, including assertions that inputs are not logged or stored, cannot be independently verified from this documentation-only package.

This finding does not establish that the current endpoint is malicious. It identifies a supply-chain and trust-boundary weakness caused by relying on an externally controlled, mutable component without verifiable provenance or integrity controls.

### Attack Path

1. A user follows the Quick Start instructions and registers the supplied remote MCP endpoint in an MCP-compatible client.
2. The endpoint operator changes the server implementation after the skill has been reviewed, or the hosting account is compromised.
3. The user invokes one of the advertised tools and sends timestamp, scheduling, or time-zone information to the remote service.
4. The modified service records the s
...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish the complete MCP server source code so users can audit the implementation and deploy it locally.
2. Pin the recommended service to a verifiable release and publish signed build artifacts, checksums, or reproducible-build instructions.
3. Clearly disclose that tool inputs leave the user's environment and identify every field transmitted to the remote server.
4. Document service ownership, data retention, logging, deletion, incident response, and privacy policies in verifiable terms.
5. Provide a local-only implementation for timestamp and time-zone calculations, which do not inherently require remote processing.
6. If remote operation remains necessary, use authenticated releases, strict transport security, request minimization, and independent monitoring for unexpected endpoint changes.
7. Advise users not to submit confidential schedules or contextual information unless they have independently assessed and accepted the service operator's trust and privacy model.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The read_when triggers use broad natural-language phrases like 'timestamp', 'convert time', 'days between', and 'time ago' without clear scoping to explicit user intent to use this remote MCP service. That can cause unintended activation of a networked tool, increasing the chance that user data or context is sent to an external service when the user only wanted a conversational answer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Detection Triggers section expands activation to many ambiguous examples such as 'what time is it in Tokyo', 'calculate duration', 'UTC offset for', and 'time ago', again without boundaries that distinguish harmless discussion from a request to call the remote server. In the context of a remote MCP endpoint, over-broad triggering raises the risk of unnecessary external requests and unintended disclosure of user prompts or derived temporal data.

Content

No source excerpt is available for this finding.