Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Home Todo
v1.0.0检查并提醒用户回家后需要处理的事项。当用户通过Dashboard（webchat）发任何消息时，自动检查待办文件并提醒。
⭐ 0· 235·0 current·0 all-time
byCRX@cyberraccoonx
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a local todo feature which reasonably requires reading and writing a todo file. However, the skill metadata declares no required config path or credentials while the instructions explicitly reference a specific file path (~/.openclaw/workspace/.home-todos.md). Also the instructions say it will record phrases said in “any channel (Feishu, iMessage, etc.)” which implies access to other messaging channels but the skill does not declare any channel tokens or permissions. The file access and cross-channel recording are not proportional to what the registry metadata lists.
Instruction Scope
The runtime instructions direct the agent to (1) read the file ~/.openclaw/workspace/.home-todos.md, (2) parse and exclude completed items, (3) add reminders to replies, and (4) append new todo items when the user says '回家要干xxx' in any channel. Reading and writing a dotfile in the user's home and capturing messages from multiple channels are broader data-access actions than the metadata indicates. The instructions are also somewhat vague about how messages from other channels are captured and what data is recorded.
Install Mechanism
Instruction-only skill with no install spec and no code files. This minimizes install-time risk (nothing is downloaded or written by an installer).
Credentials
No environment variables, credentials, or config paths are declared, yet the skill reads and writes a persistent file in the user's home directory and claims to record messages from external channels. If the agent actually has access to Feishu/iMessage data, additional permissions or tokens would normally be required; their absence in metadata is an inconsistency. Persisting user conversation-derived data to disk can expose sensitive information and should be explicit.
Persistence & Privilege
The skill will persist reminders and recorded items to a dotfile in the user's home directory and is designed to run whenever the Dashboard receives a message. It does not set always:true, so it won't be force-included everywhere, but it does rely on automatic invocation when messages arrive. Persisting user-collected messages across channels increases privacy risk—users should know and control where data is stored.
What to consider before installing
This skill intends to read/write a local todo file (~/.openclaw/workspace/.home-todos.md) and to record phrases from multiple messaging channels. Before installing: 1) Confirm you trust the skill author because it will persist user-derived data to your home directory. 2) Inspect or create the file path yourself and check its contents/permissions. 3) Verify how the agent/platform provides messages from external channels (Feishu/iMessage) and whether tokens/permissions are required—ask the author to declare those. 4) Test the skill with harmless data first. 5) If you don't want persistent storage, do not install or ask for an option to keep data in-memory only.Like a lobster shell, security has layers — review code before you run it.
latestvk979k0dycajzjtwdzpbtnt4kwd82nkjx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.