TARDIS

Track elapsed time from a set epoch with tamper-evident locking. Like an analog Hobbs meter but digital. Use for tracking uptime, service hours, time since events, sobriety counters, project duration, equipment runtime. Supports create, lock (seal), check, verify against external hash, list, and export operations.

What to consider before installing or running this skill: - Review the code locally before executing. The repository contains runnable Python scripts (meter.py, sendgrid_webhook.py) and a helper shell script that can start background services. Do not run them without inspection. - Be cautious with .env files: meter.py auto-loads ~/.env, /root/.env, and ./ . If you have sensitive secrets in those locations, the skill may read them into its process. Either remove unrelated secrets or run the skill in a sandboxed account/container. - SendGrid and gateway tokens are optional but powerful. Only provide SENDGRID_API_KEY or OPENCLAW_GATEWAY_TOKEN if you trust the skill and understand the destination (SendGrid actions send email; gateway token allows sending messages via your OpenClaw gateway). - If you plan to use the webhook server: prefer direct Discord webhooks over exposing an OpenClaw gateway token; enable SendGrid webhook signature verification (provide SENDGRID_WEBHOOK_PUBLIC_KEY and ensure the 'cryptography' dependency is available) to avoid spoofed events. - The check-webhook-services.sh script references /root paths and will try to start cloudflared and the webhook server with nohup. Do not run that script as-is on shared or production hosts. Instead adapt paths, run under a non-root user, or manage services with a proper supervisor. - The 'ACTION:' opt-in feature that can treat milestone message text as agent instructions is risky. Do not enable any agent behavior that executes remote message contents unless you fully trust the source and have strict sanitization/whitelisting. - If you only need local time tracking, consider using meter.py without enabling email/webhook features, avoid running the webhook server, and keep witness files local (or opt for paper/photo backups). If you want, I can point out the specific lines in meter.py or sendgrid_webhook.py that implement the .env auto-loading, webhook forwarding, and 'ACTION:' handling so you can review them more quickly.

Type: OpenClaw Skill Name: tardis Version: 1.2.0 The skill is classified as suspicious due to the explicit 'ACTION: Triggers' feature documented in SKILL.md and README.md, which allows milestone messages from the plaintext `meters.json` file to be executed as agent instructions, creating a direct prompt injection vector if local file access is compromised. Additionally, the `scripts/check-webhook-services.sh` script actively starts a `cloudflared tunnel` to expose a local service to the public internet, a high-risk capability, and both Python scripts read environment variables from potentially sensitive locations like `/root/.env` and `~/.env`.