WebUntis

Read-only access to Untis/WebUntis student timetables. Use when you need to fetch or summarize a student's current schedule (today/this week/date range), upcoming lessons, rooms, teachers, or substitutions from a WebUntis instance.

This skill appears to do exactly what it claims: a local read-only client for a WebUntis instance. Before installing, ensure you: (1) only provide credentials for a dedicated read-only/student account you trust (do not paste passwords into chat), (2) supply the correct WEBUNTIS_BASE_URL so credentials go to the intended school server, and (3) review or run the included script in an isolated environment if you want extra assurance. If you lose trust in the WebUntis endpoint later, rotate the account password. If you need the agent to avoid calling this skill autonomously, restrict agent permissions or only invoke it manually.

Type: OpenClaw Skill Name: webuntis Version: 1.0.1 The skill bundle is benign. The `SKILL.md` clearly outlines the purpose of read-only access to WebUntis timetables and provides secure guidance for credential handling via environment variables. The `scripts/webuntis.py` script implements this functionality by reading credentials from environment variables and making JSON-RPC calls to the configured WebUntis instance. There is no evidence of data exfiltration to unauthorized third parties, malicious command execution, persistence mechanisms, or prompt injection attempts against the agent. All actions are consistent with the stated purpose.