Roster

Creates weekly shift rosters (KW-JSON) from CSV availability data and pushes them to GitHub.

What to check before installing or enabling: 1) Limit the GitHub token: create a fine‑grained PAT scoped only to the single repo (contents: read/write, actions: write) and short lifetime; do NOT supply a broad classic repo token. 2) Test in a throwaway private repo with dummy employees to confirm behaviour and that GitHub Actions do only the expected PDF/email steps. 3) Manually inspect the repository workflows (.github/workflows/*.yml) — dispatched workflows run in repo context and can access repo secrets. 4) Review SKILL.md (and remove any hidden unicode control characters) — the file enforces mandatory emoji formatting and contains a detected unicode-control-chars pattern which is unusual; ensure there are no hidden instructions that could alter agent behaviour. 5) Be aware the skill will collect/store personal data (names, emails, minor status); keep ROSTER_REPO private and comply with data-protection rules. 6) If you want to prevent automatic writes/dispatches, do not enable autonomous invocation or run the skill only with user confirmation before any push/dispatch. If anything looks unexpected, prefer 'do not install' or test in an isolated environment first.

Type: OpenClaw Skill Name: roster Version: 1.5.0 The 'roster' skill is a legitimate tool designed to manage shift schedules by synchronizing CSV data with a GitHub repository. It utilizes a set of shell scripts (e.g., push-to-github.sh, get-employees.sh) to interact with the GitHub API, and the SKILL.md provides detailed, context-specific instructions for the AI agent to handle complex business logic like minor protection and trainer assignments. While the skill requires sensitive environment variables (GITHUB_TOKEN) and handles employee PII, the implementation uses defensive coding practices (such as using Python for safe JSON/Base64 processing within shell scripts) and the documentation explicitly emphasizes security best practices, including the use of private repositories and fine-grained access tokens.