Flowdo
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: flowdo Version: 2.0.0 The FlowDo skill is a basic shell-based task manager that performs local file operations (reading/writing to a data log). While there is a functional discrepancy between the commands described in SKILL.md (e.g., 'done', 'priority', 'stats') and the actual implementation in scripts/script.sh (e.g., 'add', 'list', 'search', 'export'), the code lacks any indicators of malicious intent, data exfiltration, or unauthorized remote access.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may expect kanban workflow tracking that the included script does not actually provide.
The script advertises and implements generic commands, while SKILL.md describes kanban features such as done, doing, priority, and stats. This is a capability/documentation mismatch, though not evidence of harmful behavior.
Commands:\n run Execute main function\n config Configuration\n status Show status\n init Initialize\n list List items\n add Add entry\n remove Remove entry\n search Search\n export Export data
Treat this as a simple local list utility unless the publisher supplies a script matching the documented commands.
Task names or command arguments could contain private information and remain in local FlowDo files until deleted.
The script stores task data and a command history in persistent local files. This is expected for a task manager, but users should know task text and command arguments may remain on disk.
DATA_DIR="${FLOWDO_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/flowdo}"\nDB="$DATA_DIR/data.log"\n_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Avoid putting secrets in task text, and review or delete the FlowDo data directory if you no longer want the history retained.