by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Things to check before installing or running this skill:
1) Verify provenance: confirm the npm package page (@temporal-cortex/cortex-mcp) and the GitHub repo/releases SKILL.md references actually exist and match the package version. The registry metadata showed Source: unknown and Homepage: none while SKILL.md lists URLs — resolve that discrepancy first.
2) Verify the binary: follow the SKILL.md verification steps (npm pack --dry-run, fetch SHA256SUMS.txt from the GitHub release, and shasum -a...详细分析 ▾
ℹ 用途与能力
The skill's name/description, required binary (npx), and the two config paths (~/.config/temporal-cortex/credentials.json and config.json) are coherent with a calendar integration that stores OAuth tokens locally. However registry metadata lists Source: unknown / Homepage: none while SKILL.md claims a homepage and GitHub repository — that provenance mismatch is unexpected and should be verified.
ℹ 指令范围
SKILL.md instructions focus on installing/running a local MCP server which reads/writes only ~/.config/temporal-cortex/, authenticates to Google/Outlook/CalDAV, and performs network calls only to calendar providers or (in Platform Mode) api.temporal-cortex.com. This is in-scope for scheduling, but Platform Mode tools (resolve_identity, query_public_availability, request_booking) call external Temporal Cortex endpoints and Open Scheduling endpoints are described as unauthenticated public APIs — understand what data (availability metadata, booking requests) will be sent to that service before enabling Platform Mode.
⚠ 安装机制
The install is an npm package (@temporal-cortex/cortex-mcp) whose postinstall downloads a platform-specific compiled binary from the project's GitHub Releases. While SKILL.md says the postinstall verifies SHA256 and suggests independent checksum verification and Docker containment, this is a supply-chain risk: a remote binary is being written and executed on your machine and there are no local source code files in the skill bundle to audit. Verify the npm package page, the GitHub release, and checksums before installing; prefer the Docker containment option if you cannot fully verify the binary.
ℹ 凭证需求
The skill declares no required environment variables (reasonable). SKILL.md documents optional env vars for custom OAuth and platform-mode settings (GOOGLE_CLIENT_ID/SECRET, MICROSOFT_CLIENT_ID/SECRET, API_BASE_URL, REDIS_URLS, LOCK_TTL_SECS). These are plausible for the described features. The notable sensitive artifact is the local credentials file (~/.config/temporal-cortex/credentials.json) which will contain OAuth tokens — expected for calendar integrations but worth protecting and verifying that tokens are not exfiltrated in Local Mode.
✓ 持久化与权限
The skill does not request 'always: true' and does not declare modification of other skills or system-wide agent settings. It does install a helper binary (cortex-mcp) and stores credentials in its own config directory; that is expected for a local calendar agent. Still verify the binary and its claimed filesystem/network restrictions before granting long-term presence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.9.12026/2/28
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install temporal-cortex-scheduling
镜像加速npx clawhub@latest install temporal-cortex-scheduling --registry https://cn.longxiaskill.com