Timedoctor

Integrates with TimeDoctor API to pull employee time tracking data, worklogs, statistics, and productivity metrics using simple Python scripts

This skill appears to be a straightforward TimeDoctor API client, but check these points before installing or using it: - Credential handling: The agent will prompt for your TimeDoctor email/password to run the login flow and obtain a JWT. Consider creating the token yourself (via curl or the TimeDoctor UI/API) and setting TIMEDOCTOR_TOKEN instead of handing your password to the agent. - Env var mismatch: SKILL.md expects TIMEDOCTOR_TOKEN and optionally TIMEDOCTOR_COMPANY_ID, but the registry metadata doesn't declare required env vars — make sure you store tokens securely and do not add them to shared shell profiles on multi-user systems. - Installation: The code requires Python and httpx (pip). Install dependencies in an isolated virtualenv rather than system Python to reduce risk. - Review code & origin: The repository/author looks like an individual project. If you will use this for production or sensitive data, review the timedoctor.py source yourself (it appears to call only api2.timedoctor.com) and verify there are no unexpected network endpoints or logging of sensitive data. If you cannot review the code or avoid entering your password, prefer manual token provisioning and limit token lifetime / scope where possible.

Type: OpenClaw Skill Name: timedoctor-skill Version: 0.1.0 The skill provides a functional integration with the TimeDoctor API but is classified as suspicious due to insecure credential handling and high-risk data access. Specifically, the `login` command in `timedoctor.py` accepts passwords as plaintext command-line arguments, which can expose them in process lists or shell history. Additionally, `SKILL.md` instructs the AI agent to solicit user passwords directly in the chat and extract JWT tokens from responses, risking credential leakage into logs or session history. The skill also includes capabilities to retrieve sensitive employee data, such as screenshots and screencasts (`get_files`), which, while aligned with the stated purpose of employee monitoring, represents a significant privacy risk.