Weekly Planner

File-based weekly planner using TOML for inbox capture, time-block scheduling, weekly review, task rollover, and optional calendar export or Google Calendar...

This skill appears to do what it says: it reads and writes planner/*.toml files and provides utilities to create/rollover/validate weeks and to export .ics files. Things to consider before installing or running: 1) Scripts require Python 3.11+ (tomllib) — confirm your environment. 2) Google Calendar sync is optional and runs the external 'gog' CLI via subprocess; only enable calendar writes if you intentionally set config.calendar.write_enabled = true and run sync_week.py with --apply. Do not point planner_calendar_id at your primary calendar unless you want the planner to create/update/delete events there. 3) The SKILL metadata suggests installing gogcli from a third‑party Homebrew tap (steipete/tap) — review that tool before installing. 4) As with any workspace script, review the included Python files (they are short, local, and readable) before running; they do not contain hidden network endpoints or require secrets. 5) Run operations in a controlled workspace (or a copy) the first time to verify behavior.

Type: OpenClaw Skill Name: weekly-planner Version: 1.0.0 The skill is generally well-designed and includes several safety mechanisms, such as dry-run modes and explicit write-enabled flags for calendar synchronization. The `SKILL.md` instructions are clear and do not contain obvious prompt injection attempts. However, the `scripts/init_planner.py` script is classified as suspicious due to its use of `shutil.rmtree(target_dir)` on a user-controlled `--target` path, especially when combined with the `--force` flag. While the script warns that `--force` is 'DANGEROUS', an agent could be prompted to provide a malicious target path (e.g., `--target / --force`), potentially leading to significant data loss or system disruption. This represents a high-impact vulnerability rather than intentional malice.