Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local SQLite-based todo manager with disclosed persistence and reminder metadata; its risks are mainly normal user-control considerations for reminders and deletion.
Install this if you want a local persistent todo database. Before using reminders, confirm the delivery channel and target because reminder details may be sent through external messaging via OpenClaw cron. Treat the delete command as permanent and prefer forgotten or expired status if you want to retain history.
The skill documents use of environment variables and a local SQLite-backed helper script, but it does not declare any explicit tool scope such as allowed tools or permissions. That makes the skill's runtime expectations under-specified and can lead an agent to access environment configuration or execute local code without clear containment or review boundaries.
The description is broad enough that the skill may be invoked for many generic task-management requests, including cases where the user did not intend persistent storage or reminder scheduling. Over-broad triggering can cause unnecessary access to local task data or unintended writes, which is a security and privacy boundary issue for an agentic system.
The skill describes reminder scheduling and default external delivery targets/channels, including examples like WhatsApp and phone numbers, without an explicit warning or consent step before sending task data externally. This creates a real risk of sensitive task content, timestamps, or identifiers being transmitted to third-party messaging channels without the user's informed approval.
The manifest frames this skill as a task manager with explicit lifecycle statuses, including expire/forget operations, but does not mention hard deletion from the database. The delete command removes task records entirely, which goes beyond the described status-based lifecycle model and loses reminder/history metadata instead of marking a task forgotten or expired.
This code file performs a destructive operation by deleting a task record from the SQLite database. Although the CLI subcommand is named 'delete', there is no confirmation prompt or explicit warning in nearby user-facing output about the irreversible data removal.
