Flowdo
PassAudited by ClawScan on May 10, 2026.
Overview
FlowDo appears to be a local-only task utility, but its documentation does not fully match the included script and it keeps task/history data on disk.
This looks safe to install if you only need a local task list, but do not rely on the advertised kanban commands unless they are added, and avoid storing sensitive secrets in task names because they are written to local files.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may expect kanban workflow tracking that the included script does not actually provide.
The script advertises and implements generic commands, while SKILL.md describes kanban features such as done, doing, priority, and stats. This is a capability/documentation mismatch, though not evidence of harmful behavior.
Commands:\n run Execute main function\n config Configuration\n status Show status\n init Initialize\n list List items\n add Add entry\n remove Remove entry\n search Search\n export Export data
Treat this as a simple local list utility unless the publisher supplies a script matching the documented commands.
Task names or command arguments could contain private information and remain in local FlowDo files until deleted.
The script stores task data and a command history in persistent local files. This is expected for a task manager, but users should know task text and command arguments may remain on disk.
DATA_DIR="${FLOWDO_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/flowdo}"\nDB="$DATA_DIR/data.log"\n_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Avoid putting secrets in task text, and review or delete the FlowDo data directory if you no longer want the history retained.