Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward TODO.md manager that can change or delete tasks when asked, with no hidden network access, privilege escalation, or background persistence found.
Install only if you are comfortable with a skill that writes to /root/.openclaw/workspace/TODO.md and can delete or change tasks when given organize or execute commands. Users who do not want Chinese default text should adjust the template/output strings or request localization support.
The file presents command names, outputs, and error messages in Chinese, but does not state that the skill is intended only for Chinese-speaking users or provide an option to use another language. This can violate the language/locale policy because the skill appears to force a specific language without user opt-in or justified regional scope.
This markdown file describes delete, edit, move, check, and uncheck operations that directly alter the user's TODO.md content, including task deletion, but it does not include any warning that these commands change stored data. Under the markdown-specific missing-warning rule, behaviors affecting user data should be disclosed so users understand the impact before invoking the skill.
The default template and display strings are written in Chinese throughout, including section headers and user-facing task text, with no indication that the user can choose another language. This creates a natural-language locale constraint that is not documented as optional or justified for a region-specific tool.
No suspicious patterns detected.
