Sauna Breathing Calm

Empathizes with user frustration, guides a 30-second box breathing exercise, offers calm reminders, then refocuses on solving the original task.

Before installing or enabling this skill, verify and clarify these points: (1) Authorization: the included script posts directly to Google Calendar but the skill declares no credential or OAuth flow — ask the developer to explicitly require and document how the agent will obtain a Google OAuth token (or define an env var like GOOGLE_CALENDAR_TOKEN) and how user consent is obtained. (2) Consent & scope: the agent should ask for explicit permission before creating events and allow the user to choose calendar/timezone/times; it must not silently write to the user's primary calendar. (3) Content: event descriptions include promotional language and a download link for sauna.ai; confirm you are comfortable with that marketing being added to your calendar entries. (4) Timezone & scheduling: the script hardcodes America/Los_Angeles and fixed times — request that scheduling respect the user's timezone and preferences. (5) Security: confirm how tokens are stored, whether the skill logs or returns calendar data, and whether you can revoke the skill's access. (6) Safety test: if you proceed, test with a disposable or secondary calendar/account first. If these issues are not addressed, treat the skill as risky to grant calendar write access.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The skill's primary function is to calm users and set up calendar reminders. The `scripts/setup-calm-reminders.js` file makes an external network call to the Google Calendar API to create events, which is a high-risk capability. However, this action is explicitly stated as the skill's purpose in `SKILL.md` ('Set Up Reminders for the user'). The calendar events include promotional content for 'Sauna.ai', which is a marketing tactic by the skill owner, not a malicious security threat like data exfiltration or system compromise. The script relies on a `PLACEHOLDER_TOKEN` for authorization, implying platform-managed consent. No evidence of intentional harmful behavior, unauthorized data access, or prompt injection against the agent was found.