WastePickupReminder

Automates customized waste collection reminders with multiple container types, schedules, targets, and confirmation via direct API messaging.

This skill appears to do what it says: it generates formatted reminder outputs for your assistant to send and stores its configuration under /data/.openclaw/workspace/data/waste-reminder. Before installing, review and consider: (1) the config will contain phone numbers, chat IDs, and possibly webhook URLs — treat that folder as sensitive and limit who/what can read it; (2) the skill does not send messages itself — your AI assistant (or another integration) will do the sending, so confirm your assistant's autonomy settings if you don't want automated outbound messages; (3) you'll need to add the cron job the README suggests (cron will call the provided script every 15 minutes); and (4) inspect the included files (waste_cron.py and waste_reminder.py) locally if you want to verify behavior — there are no hidden network endpoints in the code itself. If you want stricter control, run the cron job under a restricted account and verify directory permissions for /data/.openclaw/workspace/data/waste-reminder.

Type: OpenClaw Skill Name: waste-reminder Version: 1.0.2 The skill's Python scripts (`waste_cron.py`, `waste_reminder.py`) do not contain direct malicious code, adhere to the stated lack of network access, and perform standard file I/O within their designated directory. However, a significant prompt injection vulnerability exists against the OpenClaw AI agent. User-controlled data from `config.json` (specifically `container_name`, `container_emoji`, and `template` fields) is directly embedded into the output message generated by `waste_cron.py` without sanitization. This output is designed to be processed by the AI agent, allowing a malicious user to inject commands into the AI's instruction stream, potentially leading to unauthorized actions by the agent.