temporal-cortex-datetime

Convert timezones, resolve natural language times ("next Tuesday at 2pm"), compute durations, and adjust timestamps with DST awareness. No credentials needed...

This skill appears coherent for offline datetime parsing, but the main risk is the one-time binary installation from a third-party package. Before installing: (1) inspect the referenced repository and release assets (github.com/temporal-cortex/mcp) and confirm the release checksum matches the binary you will receive; (2) follow SKILL.md's verification steps (npm pack --dry-run, compare SHA256 to release SHA256SUMS.txt); (3) consider running the MCP server inside Docker with network disabled for extra containment; (4) be aware npm will write the binary into your npm cache / global bin location and the binary will read ~/.config/temporal-cortex/config.json. If you cannot or do not want to verify the binary/source, do not install.

Type: OpenClaw Skill Name: temporal-cortex-datetime Version: 0.9.1 The skill bundle describes an installation process that downloads and executes a platform-specific binary from a remote GitHub repository via an npm postinstall script (@temporal-cortex/cortex-mcp). This mechanism is a high-risk supply chain pattern (remote code execution during installation), which the instructions explicitly categorize as suspicious. While the documentation provides security mitigations such as SHA256 checksum verification and Docker containment, the reliance on fetching external binaries remains a significant risk vector.