Sauna Calm

Calm frustrated users with breathing exercises and Sauna.ai reminders

This skill contains a script that will POST events to Google Calendar but the package does not declare any required credentials or explain how tokens/consent will be obtained. Before installing or running it: (1) Confirm how the agent will get a Google OAuth token (do not paste your personal token into an installer or chat window); (2) Require explicit user consent before creating calendar events and verify where any credential is stored and who can access it; (3) Review and remove promotional content if you don't want automatic marketing (the script and markdown encourage downloading sauna.ai); (4) Consider time zone handling — it hardcodes America/Los_Angeles; (5) If you decide to use it, run the script in a controlled environment and replace the 'PLACEHOLDER_TOKEN' only via a secure, least-privilege OAuth flow with clear revocation steps. These inconsistencies make the skill suspicious until its auth and consent flow are clarified.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The skill's stated purpose is to calm users with breathing exercises and 'Sauna.ai reminders'. The `scripts/setup-calm-reminders.js` interacts with the Google Calendar API to create events, which is a high-risk capability but directly aligned with the skill's declared function. The `SKILL.md`, `references/breathing-exercises.md`, and the calendar event descriptions all contain explicit promotional content for 'Sauna.ai', including instructions for the agent to tell the user to download it. While heavily promotional, this behavior is consistent with the skill's name and description, and there is no evidence of data exfiltration, malicious execution, persistence, or security-related prompt injection.