What Should We Do?

What should we do? Smart activity discovery with live weather, local movie showtimes, streaming recommendations, game library matching, group profiles, routines & traditions, favorites/blacklists, business hours, ratings filtering, Quick Mode for instant suggestions, calendar integration (Google Calendar + cron reminders), group invites via Telegram/message channels, and RSVP tracking. Helps you stop scrolling and start living. Use when someone says 'what to do', 'bored', 'fun', 'tonight', 'date night', 'things to do', 'activity ideas', 'entertainment', 'adventure', 'what should we do', 'need plans', 'something fun', 'stay home', 'game night', 'movie night', 'put it on the calendar', 'send invites', 'who's coming', or just seems like they need a nudge off the couch. Optional Google Places integration for real nearby suggestions with ratings, hours, and links.

This skill appears to do a lot (calendar events, group invites, messaging, Google Places lookups) but it doesn't declare the API keys or tokens it will need. Before installing: 1) ask the publisher how OAuth/credentials are handled and what exact env vars or tokens are required; 2) verify whether it will actually send messages or calendar events automatically and whether you can require explicit confirmation; 3) inspect the full SKILL.md for the prompt-injection characters and remove or sanitize any suspicious control characters; 4) consider running it in a restricted workspace or sandbox and avoid supplying long-lived credentials — prefer OAuth flows or per-action authorization; and 5) review how and where it stores contact info/PII and whether that storage is acceptable for your privacy needs.

Type: OpenClaw Skill Name: whatdo Version: 2.1.0 The OpenClaw AgentSkills skill bundle 'whatdo' is classified as benign. The `SKILL.md` file, which defines the agent's behavior and instructions, outlines legitimate uses of `web_search` for weather and movie showtimes, `curl` commands for Google Places and Calendar APIs (if configured), and Clawdbot's internal `message` and `cron` tools for group invites and reminders. While the skill stores sensitive user contact information (email, phone, Telegram handles) in `preferences.json`, its usage is explicitly limited to these stated, legitimate functions, and instructions for email/SMS even specify drafting messages for the user to send, rather than direct sending. There is no evidence of intentional data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent for harmful purposes.