Fcalendar Skill
v0.1.2Recognizes and resolves Chinese and English time expressions to exact dates and queries Chinese public holidays and weekends by date range.
⭐ 1· 381·57 current·57 all-time
byyoungfree@youngfreefjs
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (recognize/resolve Chinese/English time expressions and query Chinese holidays) match the instructions and supporting reference files. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Runtime instructions are focused on installing and invoking a Python package (python3 -m fcalendar), querying dates, and using --today. They do not ask the agent to read unrelated files or exfiltrate data. Note: the SKILL.md asserts the package "does not access network resources or collect user data", which is a claim from the package author — it cannot be verified from the instruction-only skill; the agent will install and run third‑party code if followed.
Install Mechanism
No install spec embedded in the skill, but the SKILL.md instructs users to pip install fcalendar from PyPI and links to a GitHub repo. Installing from PyPI is expected for a Python utility but carries the usual moderate risk: packages and their install scripts can execute arbitrary code. The provided upstream links are helpful for review.
Credentials
The skill requires no environment variables, no credentials, and no special config paths — this is proportionate for a local date/holiday resolver.
Persistence & Privilege
The skill does not request always:true and does not ask to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default), which is expected for skills.
Assessment
This skill appears to do what it says: parse time expressions and report Chinese holidays. The main security consideration is that the SKILL.md tells you to pip install the third‑party package fcalendar from PyPI (and points to a GitHub repo). Before installing or letting an agent run it automatically: 1) review the package source on GitHub (and any setup.py/pyproject hooks) for unexpected network calls or post‑install code; 2) install into an isolated virtualenv or sandbox; 3) prefer pinning a specific version (e.g., pip install fcalendar==0.1.2) and check the PyPI package details and recent releases; 4) if you cannot review the code, avoid installing or run it in an offline/sandboxed environment. The skill's claim that the package "does not access network resources" is an author statement — verify it by inspecting the code rather than trusting it.Like a lobster shell, security has layers — review code before you run it.
latestvk971j52jk75n7tz2ckvw9556y1843het
License
MIT-0
Free to use, modify, and redistribute. No attribution required.