ClawHub

TODO Tracker (Safe)

v1.0.1

Secure TODO tracker with input validation and safe file operations. Use for task management across sessions.

⭐ 0· 376·1 current·1 all-time
byAlex Chen@gothicfox
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (local TODO tracker) align with what is present: a bash script that reads/writes a TODO.md and uses bash/grep/awk/sed. No unrelated credentials, binaries, or network access are requested.
ℹ
Instruction Scope
SKILL.md and the script limit actions to local file operations, listing, adding, marking done, and summarizing tasks. The README and SKILL.md claim no env vars except TODO_FILE, but the script also reads HOME to build a default path (normal for local tools). The skill states it may display a summary on heartbeat — that implies autonomous invocation may cause periodic reads of the TODO file, which is consistent with the stated behavior.
✓
Install Mechanism
No install spec; instruction-only with an included script. Nothing is downloaded or written by an installer, so there is no remote install risk.
ℹ
Credentials
No required environment variables are declared. The script optionally respects TODO_FILE (reasonable). It also uses HOME implicitly to compute the default path — this is typical for a local file-based tool but is a minor mismatch with the SKILL.md phrasing that claimed 'no env var reading except TODO_FILE.'
✓
Persistence & Privilege
always:false and no modifications to other skills or global agent configs. The script writes only to the user-specified (or default) TODO file; it requires an existing writable directory to create the file and will error otherwise.
Assessment
This script is a local, file-based TODO manager and appears to do only safe, text-file operations. Before installing: ensure you are comfortable the default path (~/.openclaw/workspace/TODO.md) is acceptable (or set TODO_FILE), create the containing directory with correct permissions so the script can initialize the file, and be aware the agent may autonomously show the summary (heartbeat) which will read that file. If you want to be extra cautious, review the included scripts/todo.sh yourself — it contains the full implementation and no network/calls to external services were found.

Like a lobster shell, security has layers — review code before you run it.

latestvk975gyhqhr2k4d486kkbdr4rjh831kmcsafevk975gyhqhr2k4d486kkbdr4rjh831kmcsecurityvk975gyhqhr2k4d486kkbdr4rjh831kmc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📋 Clawdis
Binsbash, grep, awk, sed

Comments