Wilma Triage

Daily triage of Wilma school notifications for Finnish parents. Fetches exams, messages, news, schedules, and homework — filters for actionable items, syncs...

This skill appears to do what it says, but there are metadata and scope gaps you should verify before installing: 1) Confirm you have and trust the 'wilma' and 'gog' CLIs (and the referenced 'wilma'/'gog' skills from ClawHub) because the skill runs their commands. 2) Be aware it will read your Wilma config (~/.config/wilmai/config.json) and gog CLI app data (~/Library/Application Support/gogcli/), but those paths were not declared in the registry — ensure you are comfortable with the agent accessing those local credentials. 3) The skill will write the calendar ID to TOOLS.md and store preferences in MEMORY.md (persistent agent files) — check these files for sensitive content and accept that they will be modified. 4) Because source/homepage is unknown, consider inspecting the 'wilma' and 'gog' skill code or running the commands manually first to confirm behavior. If you are uncomfortable with the agent reading/writing config or persistent files, do not install or run until the declarations and provenance are clarified.

Type: OpenClaw Skill Name: wilma-triage Version: 1.0.1 The skill instructs the agent to store user-provided data, including 'exact gog CLI commands' and 'naming conventions for events', into `TOOLS.md` and `MEMORY.md`. Subsequently, the agent is directed to 'Refer to TOOLS.md for... exact gog CLI commands' and 'Check MEMORY.md for additional skip/report rules'. This design pattern creates a significant prompt/command injection vulnerability, as a malicious user could potentially inject arbitrary commands or instructions into these files, which the agent would then execute. While the skill itself does not contain malicious payloads, it establishes a high-risk mechanism for agent control via external, user-modifiable files, classifying it as suspicious due to this critical vulnerability.