ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TODO Tracker

v1.0.0

Persistent TODO scratch pad for tracking tasks across sessions. Use when user says "add to TODO", "what's on the TODO", "mark X done", "show TODO list", "remove from TODO", or asks about pending tasks. Also triggers on heartbeat to remind about stale items.

⭐ 0· 5.9k·49 current·55 all-time
byJonathan Rhyne@jdrhyne
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description match the provided files: SKILL.md and scripts/todo.sh implement a persistent TODO.md scratch pad. The skill only needs standard POSIX tooling (awk/sed/grep/mv) which is appropriate for the described functionality. There are no unrelated environment variables, binaries, or external services requested.
ℹ
Instruction Scope
Runtime instructions confine activity to creating, reading, and updating TODO.md in the workspace and invoking the included bash script. The script uses pattern matching (grep/sed) to find and manipulate items and supports a heartbeat summary that will include counts and short item lines. This is within scope, but two operational notes: (1) pattern-based matching can accidentally match multiple items or unintended text (risk of unintentional deletion/move), and (2) the heartbeat/summary will cause TODO contents (or summaries of them) to be included in agent responses — avoid putting secrets in the TODO file.
✓
Install Mechanism
No install spec or external downloads — instruction-only with a bundled script. Nothing is written to disk by a network installer; the only file modifications are to TODO.md in the workspace via the included script.
ℹ
Credentials
The skill declares no required env vars or credentials (and indeed the script has no secret-requiring behavior). The script does allow overriding TODO_FILE via the TODO_FILE environment variable (defaulting to TODO.md) even though no env is declared — this is reasonable but worth noting. Crucially: any sensitive information added to TODO.md will be stored in plaintext and may be echoed in summaries or agent responses, so users should not put secrets in the TODO.
✓
Persistence & Privilege
always:false (not force-included). The skill doesn't request persistent elevated privileges or modify other skills or global agent settings. Its persistence is limited to maintaining a file in the workspace and optionally participating in heartbeat summaries.
Assessment
This skill appears to do exactly what it says: maintain a local TODO.md using a bundled bash script. Before installing, consider: (1) back up any existing TODO.md in your workspace (the script will create/modify TODO.md by default), (2) do not store credentials or sensitive text in the TODO file because heartbeat summaries and agent responses may reveal its contents, (3) if you want the file in a different location set TODO_FILE to a path you control, and (4) pattern-matching commands (done/remove) match by text and may affect multiple items — review matches before running in critical workspaces. If any of these behaviors are undesirable, review or edit scripts/todo.sh (it's plain shell) before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk977jj5x342jph8fekj1pqw6fd7zc6s9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments