Task Watcher Skill

PassAudited by ClawScan on May 10, 2026.

Overview

This task watcher is coherent and purpose-aligned, but it stores shared task state, can run on a cron schedule, and can post notifications through your configured OpenClaw/Discord setup.

This skill appears safe for its stated purpose if you want recurring task monitoring. Before installing, confirm you are comfortable with a cron-based watcher, shared task-state files under ~/.openclaw, and Discord notifications sent through your configured OpenClaw agent. Use expirations, keep the shared-context directory private, and remove the cron job when monitoring is no longer needed.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI10: Rogue Agents

What this means

The watcher can keep running in the background and may continue sending task notifications after the initial setup.

Why it was flagged

The skill documents a recurring cron-based watcher. This is disclosed and user-directed, but it is persistent automation that will continue polling and notifying until the cron entry or tasks are removed.

Skill content

Cron (*/3 * * * *) → watcher.py ... # Add to crontab - every 3 minutes
*/3 * * * * cd ~/.openclaw/workspace/skills/task-watcher && \
  python3 scripts/watcher.py --once >> ~/.openclaw/logs/watcher.log 2>&1

Recommendation

Only add the cron job if you want ongoing monitoring; set task expirations, review the task store periodically, and remove the cron entry when no longer needed.

Low

#ASI03: Identity and Privilege Abuse

What this means

Notifications may be posted to Discord channels using the permissions of your local OpenClaw/Discord configuration.

Why it was flagged

Discord delivery is performed through the local OpenClaw agent identity. This is expected for the skill, but it means the configured agent/account is used to post messages.

Skill content

cmd = [
    node_path, self.openclaw_bin,
    "agent",
    "--agent", self.agent_id,
    "--channel", "discord",
    "--deliver",
    "--message", "[Watcher] " + message,
]

Recommendation

Verify the configured agent identity and Discord channel permissions, and avoid registering tasks that can notify unintended channels.

Low

#ASI06: Memory and Context Poisoning

What this means

Task IDs, target object IDs, channel references, states, and notification records may remain on disk and drive future notifications.

Why it was flagged

The skill persists active tasks, audit logs, and notification records in shared OpenClaw context. That is central to its design, but shared persistent state can be stale or influenced by other local agents/users with write access.

Skill content

`~/.openclaw/shared-context/monitor-tasks/tasks.jsonl` | Active tasks |
`~/.openclaw/shared-context/monitor-tasks/audit.log` | Audit trail |
`~/.openclaw/shared-context/monitor-tasks/notifications/` | Notification files |

Recommendation

Keep the shared-context directory access-limited, use expires_at values, and inspect or clean old task records when monitoring is complete.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing from an unverified external clone could differ from the reviewed ClawHub artifact.

Why it was flagged

The README offers an optional direct GitHub clone path. It is user-directed and not an automatic install script, but users should still verify provenance if installing from that source.

Skill content

# Or clone directly
git clone https://github.com/lanyasheng/task-watcher.git ~/.openclaw/workspace/skills/task-watcher

Recommendation

Prefer the registry install path or verify the repository, commit, and files before using the direct clone option.