Task Tracker

This skill largely looks like a local task manager, but a few mismatches deserve attention before installing: - Review the actual script contents (scripts/*.py and scripts/telegram-commands.sh) before running the install or init script. The SKILL.md will run python3 scripts/init.py — inspect that script to see what files it creates or modifies. - Check for network calls in the scripts (HTTP requests, curl, or use of telegram APIs). If the skill is going to post to Telegram, it should declare the TELEGRAM_TOKEN or similar credential; absence of such an env var in the registry is suspicious. Don't provide secrets until you confirm where/how they're used. - Be cautious with the extract_tasks flow: it parses free text and emits shell commands like tasks.py add ... — ensure those outputs are never executed automatically on untrusted input to avoid injection. Prefer manual review of extracted commands or add sanitization. - Because the model can invoke the skill by default, consider setting disableModelInvocation or requiring explicit user triggers if you want to avoid autonomous modifications to your TASKS.md. If you want higher confidence, provide the contents of the scripts (init.py, tasks.py, extract_tasks.py, telegram-commands.sh) so they can be inspected for network destinations, shell execution, credential use, or writes to paths outside ~/clawd/memory/work.