hour-meter
Tracks elapsed time with tamper-evident locking, supporting milestones and email notifications for events and projects.
Install this skill
Security score
The hour-meter skill was audited on Feb 9, 2026 and we found 24 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 174 | ## SendGrid Email Webhook Server |
Webhook reference - potential data exfiltration
| 181 | # Start webhook server with Discord webhook (recommended) |
Webhook reference - potential data exfiltration
| 182 | python sendgrid_webhook.py --port 8089 --discord-webhook https://discord.com/api/webhooks/xxx/yyy |
Webhook reference - potential data exfiltration
| 185 | python sendgrid_webhook.py --process-events |
Webhook reference - potential data exfiltration
| 186 | python sendgrid_webhook.py --process-events --json |
Webhook reference - potential data exfiltration
| 189 | ### Discord Webhook Setup (Recommended) |
Webhook reference - potential data exfiltration
| 191 | 1. In your Discord channel, go to **Settings > Integrations > Webhooks** |
Webhook reference - potential data exfiltration
| 192 | 2. Click **New Webhook**, copy the URL |
Webhook reference - potential data exfiltration
| 193 | 3. Pass to `--discord-webhook` or set `DISCORD_WEBHOOK_URL` env var |
Webhook reference - potential data exfiltration
| 197 | 1. Go to **SendGrid > Settings > Mail Settings > Event Webhook** |
Webhook reference - potential data exfiltration
| 198 | 2. Click **"Create new webhook"** (or edit existing) |
Webhook reference - potential data exfiltration
| 199 | 3. Set HTTP POST URL to: `https://your-domain.com/webhooks/sendgrid` |
Webhook reference - potential data exfiltration
| 204 | 5. Click **"Test Integration"** to verify - this fires all event types to your webhook |
Webhook reference - potential data exfiltration
| 205 | 6. **Important:** Click **Save** to enable the webhook! |
Webhook reference - potential data exfiltration
| 206 | 7. (Optional) Enable **Signed Event Webhook** for security and set `SENDGRID_WEBHOOK_PUBLIC_KEY` |
Webhook reference - potential data exfiltration
| 208 |  |
Webhook reference - potential data exfiltration
| 224 | SENDGRID_WEBHOOK_PUBLIC_KEY # For signature verification (optional) |
Webhook reference - potential data exfiltration
| 225 | SENDGRID_WEBHOOK_MAX_AGE_SECONDS # Max timestamp age (default: 300) |
Webhook reference - potential data exfiltration
| 226 | WEBHOOK_PORT # Server port (default: 8089) |
Webhook reference - potential data exfiltration
| 227 | DISCORD_WEBHOOK_URL # Discord webhook URL |
Webhook reference - potential data exfiltration
| 228 | WEBHOOK_LOG_FILE # Log file path |
Access to hidden dotfiles in home directory
| 57 | **3️⃣ WITNESS FILE** — Auto-saved to `~/.openclaw/meter-witness.txt` |
External URL reference
| 182 | python sendgrid_webhook.py --port 8089 --discord-webhook https://discord.com/api/webhooks/xxx/yyy |
External URL reference
| 199 | 3. Set HTTP POST URL to: `https://your-domain.com/webhooks/sendgrid` |