Taiwan Calendar Plugin

Taiwan calendar query for accurate working day/holiday information. Use when user asks about Taiwan dates, working days, holidays, make-up workdays, or needs date calculations. Solves Claude's knowledge cutoff issues with Taiwan's administrative calendar.

This skill appears to do what it claims: query public Taiwan calendar APIs and compute working-day math. Before installing, consider: 1) Network access — the script makes outbound HTTPS requests to data.gov.tw, data.ntpc.gov.tw and a jsdelivr (GitHub CDN) URL; if your environment restricts network egress or you distrust third-party CDNs, review or host the source data yourself. 2) SSL handling — the code contains logic that may disable SSL verification for some endpoints (which increases MITM risk); if you are concerned, inspect and modify the script to enforce verify=True. 3) Local cache — the script writes a small JSON cache to the system temp directory (no secrets expected), so ensure that is acceptable. 4) Autonomy — the skill runs a shell command when used; only enable it if you trust the author or have reviewed the included script. If you want extra assurance, run the script locally and inspect network requests it makes before enabling the plugin for autonomous use.

Type: OpenClaw Skill Name: taiwan-calendar Version: 0.0.1 The skill bundle is benign. It provides Taiwan calendar information by querying government open data APIs. The `SKILL.md` correctly defines the `Bash` tool usage to execute the Python script with specific arguments, preventing arbitrary shell command injection from user input. The `scripts/taiwan_calendar.py` fetches data from legitimate government sources (cdn.jsdelivr.net/gh/ruyut/TaiwanCalendar, data.ntpc.gov.tw) and caches it in the system's temporary directory. While the script uses `verify=False` for one API source, which is a minor security vulnerability (MITM risk for that specific API call), it is a common workaround for problematic public APIs and does not indicate malicious intent. There is no evidence of data exfiltration, persistence mechanisms, or prompt injection attempts designed to mislead the agent into performing unauthorized actions.