Student Timetable

Student timetable manager for self or parent-managed child profiles. Includes init flow + profile registry under schedules/profiles/.

This skill appears to be what it says: a local timetable manager that reads and writes JSON under schedules/profiles/. Before installing or running it, consider: - Review skill_runtime.js and tool.js (they were present but not shown here) to confirm when web_fetch/web_search are used and what endpoints they contact. academic_calendar_import.js contains code to fetch remote pages — if you will allow network access, verify its behavior and allowed domains. - The init flow is interactive (readline) and will create files in schedules/profiles/ and schedules/backups/. Back up any existing schedules directory before running migrations or init. - Because the source/homepage are unknown, exercise caution: run in an isolated workspace or sandbox rather than a production/user-data directory until you've audited the entire code (especially skill_runtime.js and tool.js). - If you plan to let an autonomous agent invoke this skill, be aware it can read and write schedule files and potentially perform network fetches (see above). If you want to avoid interactive prompts or unintended network activity, run CLI commands manually after review. If you want, provide the contents of skill_runtime.js and tool.js and I can inspect them specifically for network calls, obfuscated code, or other risks—that would raise confidence from 'medium' to 'high'.

Type: OpenClaw Skill Name: student-timetable Version: 0.1.0-alpha.4 The skill is classified as suspicious due to its use of network capabilities (`web_search`, `web_fetch`) in `academic_calendar_import.js`. While these functions are plausibly needed for the stated purpose of importing academic calendars and include some safeguards (e.g., `isOfficialSource` URL filtering, `maxChars` limit on fetch), network access inherently carries risks such as potential SSRF or data exfiltration if the safeguards were to be bypassed or if the skill's intent were to change. There is no clear evidence of intentional malicious behavior like credential theft, unauthorized command execution, or persistence mechanisms. All file system operations are confined to the skill's designated data directories (`schedules/profiles/`, `schedules/backups/`).