temporal-cortex-scheduling

List events, find free slots, and book meetings across Google Calendar, Outlook, and CalDAV. Multi-calendar availability merging, recurring event expansion,...

Things to check before installing or running this skill: 1) Verify provenance: confirm the npm package page (@temporal-cortex/cortex-mcp) and the GitHub repo/releases SKILL.md references actually exist and match the package version. The registry metadata showed Source: unknown and Homepage: none while SKILL.md lists URLs — resolve that discrepancy first. 2) Verify the binary: follow the SKILL.md verification steps (npm pack --dry-run, fetch SHA256SUMS.txt from the GitHub release, and shasum -a 256 against the installed binary). If you cannot independently verify the release, prefer the Docker containment workflow so the binary writes only to a mounted config directory. 3) Protect credentials: the skill stores OAuth tokens at ~/.config/temporal-cortex/credentials.json. Treat that file as sensitive. Inspect its contents and back it up appropriately. Ensure your OAuth app/client secrets (if you provide them) are for a dedicated app and not reuse high-privilege credentials. 4) Understand Platform Mode and Open Scheduling: Platform Mode will call api.temporal-cortex.com for cross-user discovery/booking. Open Scheduling exposes unauthenticated public endpoints for a user's Temporal Link — using those features can publish availability and allow bookings without OAuth. If you do not want data shared with Temporal Cortex servers or public availability, keep the skill in Local Mode and do not enable Open Scheduling. 5) If you need higher assurance: review the project's source repository and CI build artifacts (reproducible build claims), or run the MCP server inside a container with the config directory mounted. If you cannot validate the binary and provenance, treat installation as higher-risk. What would change this assessment: if the registry metadata were corrected to link to a verifiable npm package and GitHub release whose checksums and reproducible build logs match the distributed binary (and you can audit the source), this would move the assessment toward benign. Conversely, if the package registry or claimed releases cannot be found or checksums don't match, consider it unsafe.

Type: OpenClaw Skill Name: temporal-cortex-scheduling Version: 0.9.1 The temporal-cortex-scheduling skill provides a comprehensive set of tools for managing Google, Outlook, and CalDAV calendars. It utilizes a local MCP server (a Rust binary distributed via npm) with well-documented security practices, including SHA256 checksum verification during installation and a Two-Phase Commit protocol for booking safety. The skill stores OAuth credentials locally at ~/.config/temporal-cortex/ and includes explicit instructions for the AI agent to seek user confirmation before performing write operations or sending proposals. No evidence of malicious intent, unauthorized data exfiltration, or harmful prompt injection was found.