Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Opentask Skill

v1.4.0

OpenTask 分布式任务管理系统。查询和管理 OpenClaw 容器的任务。使用场景:(1) 查询待执行任务、获取任务列表、任务详情;(2) 创建任务、开始执行、完成任务、标记失败、重试、取消;(3) 查看今日统计、任务日志;(4) HEARTBEAT 集成任务检查。触发短语:"查询任务"、"获取任务"、"创...

0· 76·0 current·0 all-time
byAndy Tien@linux2010

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for linux2010/opentask-client.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Opentask Skill" (linux2010/opentask-client) from ClawHub.
Skill page: https://clawhub.ai/linux2010/opentask-client
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install opentask-client

ClawHub CLI

Package manager switcher

npx clawhub@latest install opentask-client
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md clearly requires OPENTASK_API_KEY and OPENTASK_HOST (and optionally OPENTASK_BOT_NAME) to talk to an OpenTask service, which is coherent with the described task-management purpose. However the registry metadata lists no required environment variables or primary credential — that is an inconsistency (the skill will not function without those secrets). The absence of a declared primary credential in metadata is a red flag for transparency.
Instruction Scope
Runtime instructions are explicit and narrowly focused on calling the OpenTask HTTP API (curl to $OPENTASK_HOST with X-Bot-Key). They also instruct the agent/environment to obtain an instance id via several methods: reading injected Runtime metadata, ~/.openclaw/.env, container hostname, or HEARTBEAT.md. Reading local config files or host metadata is relevant for assigning tasks but expands the skill's read-surface and should be acknowledged before use.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — it does not install binaries or download code. That minimizes install-time risk.
!
Credentials
The environmental access the skill needs (API host and API key) is proportionate for an API client. However those required env vars are not declared in the registry metadata (which lists none). The SKILL.md also suggests reading ~/.openclaw/.env and openclaw.json and inferring container hostnames; those are broader file reads than a minimal client and could expose other environment settings if those files contain unrelated secrets.
Persistence & Privilege
The skill does not request always:true and is user-invocable; it does not request system-wide changes or persistent installation. Autonomous invocation is allowed (default) which is expected for skills; combine this with other flags when assessing risk.
What to consider before installing
Key points to consider before installing: - Metadata mismatch: The skill requires OPENTASK_API_KEY and OPENTASK_HOST to function, but the package metadata does not declare these required environment variables. Ask the publisher to update the registry metadata so required secrets are visible before you install. - Trust the API host: The skill will send data and task updates to whatever you set as OPENTASK_HOST. Only point it at an internal/trusted service. Prefer an HTTPS endpoint and validate TLS to avoid leaking keys. - Minimize API key scope: Create a dedicated API key with least privilege for this agent (limit actions, IPs, or lifetime if possible). Do not reuse broad credentials. - Local file access: The instructions recommend reading ~/.openclaw/.env, openclaw.json, container hostname, or HEARTBEAT.md to determine the instance id. Ensure those files do not contain unrelated secrets you wouldn't want consumed by the skill. - Autonomous runs: The skill can be invoked autonomously by default. If you do not want the agent to call the OpenTask API without a human in the loop, restrict autonomous invocation or monitor runs. - Source verification: There is no homepage or publisher info. If you plan to use this in production, request provenance (source repo, maintainer contact, changelog). Consider code review of the real OpenTask server and network monitoring during initial use. What would increase confidence: registry metadata that declares OPENTASK_API_KEY and OPENTASK_HOST, publisher/contact info or a public repo, and confirmation that the skill will not read other sensitive files beyond the listed OpenClaw config paths.

Like a lobster shell, security has layers — review code before you run it.

latestvk97caqnqcs3m6e9j5nq9d48rt585evy2
76downloads
0stars
5versions
Updated 4d ago
v1.4.0
MIT-0

opentask-client Skill

分布式任务管理系统,为 OpenClaw 容器分配和管理任务。

环境变量配置

必须在 OpenClaw 中配置以下环境变量:

变量说明
OPENTASK_API_KEYAPI 认证密钥(从服务端获取)
OPENTASK_HOST服务地址(本地或容器地址)
OPENTASK_BOT_NAME当前实例标识(可选,见下方说明)

配置方式:

方式文件说明
本地实例~/.openclaw/.env添加环境变量
Docker 容器openclaw.jsonenv 配置块
临时使用shell 变量export 命令

🎯 如何获取实例标识 (assigned_to)

assigned_to 是任务分配的目标实例标识,有以下获取方式:

方式 1:OpenClaw Runtime 元数据(推荐)

OpenClaw 会自动注入 Runtime 信息到系统提示:

Runtime: agent=main | host=xxx | ...

Agent 值即为当前实例标识:

Runtime agent说明
main主实例(主会话)
{container_name}Docker 容器实例

方式 2:环境变量(可选)

配置 OPENTASK_BOT_NAME 环境变量:

# .env 文件
OPENTASK_BOT_NAME=anna

方式 3:容器名推断(Docker)

根据容器名自动推断:

# 容器名 openclaw-anna → assigned_to=anna
# 容器名 openclaw-trump → assigned_to=trump
BOT_NAME=$(hostname | sed 's/openclaw-//')

方式 4:HEARTBEAT.md 配置

在 HEARTBEAT.md 中硬编码(适合固定环境):

curl "$OPENTASK_HOST/api/tasks/pending?assigned_to=main"

服务信息

信息
服务地址$OPENTASK_HOST
API 前缀/api
认证 HeaderX-Bot-Key
API Key$OPENTASK_API_KEY

快速使用

获取待执行任务

# 使用 Runtime agent 值
curl -H "X-Bot-Key: $OPENTASK_API_KEY" \
  "$OPENTASK_HOST/api/tasks/pending?assigned_to={agent}"

返回按优先级排序的任务 (P0 > P1 > P2)。

创建任务

curl -X POST -H "X-Bot-Key: $OPENTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task_name":"任务名称","assigned_to":"{target}","priority":"P1","created_by":"{creator}"}' \
  "$OPENTASK_HOST/api/tasks"

开始执行

curl -X PUT -H "X-Bot-Key: $OPENTASK_API_KEY" \
  "$OPENTASK_HOST/api/tasks/{id}/start"

完成任务

curl -X PUT -H "X-Bot-Key: $OPENTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"result":"执行成功"}' \
  "$OPENTASK_HOST/api/tasks/{id}/complete"

HEARTBEAT 集成

在 HEARTBEAT.md 中添加任务检查(使用通用模板):

## 📋 OpenTask 任务检查

### 检查步骤

1. **获取待执行任务**
   ```bash
   curl -s -H "X-Bot-Key: $OPENTASK_API_KEY" \
     "$OPENTASK_HOST/api/tasks/pending?assigned_to=$OPENTASK_BOT_NAME" | python3 -m json.tool
  1. 有任务则执行

    • 获取第一条任务 ID
    • 调用 /api/tasks/{id}/start 开始执行
    • 执行任务逻辑
    • 完成后调用 /api/tasks/{id}/complete
  2. 无任务则 HEARTBEAT_OK


---

## priority 值

| 值 | 说明 |
|------|------|
| `P0` | 紧急(立即执行,阻塞其他任务) |
| `P1` | 重要(优先执行) |
| `P2` | 一般(有空时执行) |

---

## status 值

| 值 | 说明 |
|------|------|
| `pending` | 待执行 |
| `running` | 执行中 |
| `completed` | 已完成 |
| `failed` | 失败 |
| `cancelled` | 已取消 |

---

## 日志记录

每次状态变更都会写入 `bot_task_log` 表:

| 字段 | 说明 |
|------|------|
| `task_id` | 任务 ID |
| `action` | 操作类型 (start/complete/fail/retry/cancel) |
| `old_status` | 原状态 |
| `new_status` | 新状态 |
| `message` | 操作消息 |
| `operator` | 操作者 |
| `created_time` | 操作时间 |

---

## 完整 API 文档

详细 API 接口说明请参考 [api.md](references/api.md)。

---

## 使用示例

### 场景 1:HEARTBEAT 检查任务

```bash
# 从 Runtime 获取实例标识(假设 agent=main)
BOT_NAME="main"

# 获取待执行任务
TASKS=$(curl -s -H "X-Bot-Key: $OPENTASK_API_KEY" \
  "$OPENTASK_HOST/api/tasks/pending?assigned_to=$BOT_NAME")

# 解析任务数量
COUNT=$(echo "$TASKS" | python3 -c "import sys,json; print(len(json.load(sys.stdin)))")

if [ "$COUNT" -gt 0 ]; then
  echo "有 $COUNT 条待执行任务"
  # 开始执行第一条任务
  TASK_ID=$(echo "$TASKS" | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])")
  curl -X PUT -H "X-Bot-Key: $OPENTASK_API_KEY" "$OPENTASK_HOST/api/tasks/$TASK_ID/start"
else
  echo "HEARTBEAT_OK"
fi

场景 2:创建并执行任务

# 1. 创建任务(分配给特定实例)
TARGET="anna"

TASK=$(curl -s -X POST -H "X-Bot-Key: $OPENTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task_name":"发送问候","assigned_to":"'$TARGET'","priority":"P1"}' \
  "$OPENTASK_HOST/api/tasks")

TASK_ID=$(echo "$TASK" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

# 2. 目标实例开始执行(在其 heartbeat 时)
# 3. 完成任务
curl -X PUT -H "X-Bot-Key: $OPENTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"result":"问候已发送"}' \
  "$OPENTASK_HOST/api/tasks/$TASK_ID/complete"

数据库表结构

OpenTask 使用以下数据库表(需在部署时创建):

表名说明
bot_task任务表
bot_task_log任务日志表

数据库连接信息由部署环境决定,不在此文档中硬编码。

Comments

Loading comments...