EffortList AI (Organize Your Life /w Safety)

Manage EffortList AI folders, tasks, and todos. Use when the user wants to organize their life, track projects, or manage schedules via the EffortList AI pla...

Security Scan

The skill is internally consistent with its stated purpose: an instruction-only integration with EffortList AI that only requires a single service API key and contains no unrelated installs, binaries, or credential requests.

Purpose & Capability

The name/description describe task and schedule management and the SKILL.md + references exclusively document EffortList API endpoints and behaviors. The only required environment variable is EFFORTLIST_API_KEY, which is appropriate for a REST API integration. No unrelated services, binaries, or system access are requested.

Instruction Scope

Runtime instructions are focused on EffortList endpoints (create/list/patch/delete folders/tasks/todos, availability, undo/redo, /me) and include sensible safety guidance (rate limits, booking protections, timezone alignment). They do not instruct reading local files or other unrelated environment variables. Note: the doc suggests storing the API key in OpenClaw internal config (openclaw config set ...), which will persist the secret in agent config—this is expected but worth the user's awareness.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing is downloaded or written to disk by the skill's package itself.

Credentials

Only EFFORTLIST_API_KEY is required and it directly matches the documented bearer-token authentication (efai_<48 hex chars>). No additional secrets, credentials, or unrelated env vars are requested.

Persistence & Privilege

always:false (no forced inclusion). disable-model-invocation is false (normal). The SKILL.md suggests storing the API key in OpenClaw config (persistent storage) which grants the agent ongoing access to the EffortList account while the key remains present—this is expected for convenience but is a persistent privilege the user should consider.

Assessment

This skill appears to legitimately implement an EffortList AI integration and only asks for the service API key. Before installing: 1) Verify you trust effortlist.io and the skill publisher (source is unknown in the registry metadata). 2) Prefer supplying the API key via an environment variable rather than writing it into OpenClaw's persistent config unless you understand the implications. 3) Be aware the key is persistent and grants full access to your EffortList data (including destructive operations and appointment cancellations); require explicit user confirmation before any destructive actions. 4) Confirm the developer subscription and key lifecycle (docs say keys are shown once and can only be revoked in the dashboard). 5) If you have concerns about scope, create a separate EffortList account or key you can safely revoke for testing. If you want a tighter review, provide the exact OpenClaw config behavior for stored secrets or evidence of the publisher's identity and website verification.

📋 EffortList AI (Universal Skill)

🌟 Value Proposition (For Humans)

EffortList AI is a sophisticated life-management platform that merges advanced Generative AI with a robust, deterministic scheduling engine. Use this skill to give your agent full control over your project organization, time protection, and project lifecycles.

🚀 Setup & Authentication

1. Subscription: Requires a developer subscription ($5/month) at effortlist.io.
2. API Key: Human user must generate a Persistent API Key in Developer Settings.
3. Storage: Provide the key via the EFFORTLIST_API_KEY environment variable or OpenClaw internal config (openclaw config set skills.entries.effortlist-ai.env.EFFORTLIST_API_KEY "your_key").

📐 Mental Model (Data Hierarchy)

EffortList AI operates on a strictly nested hierarchy: Folder (Container) ──> Task (Project) ──> Todo (Actionable Slot)

• Folders: Optional top-level containers for grouping related projects.
• Tasks: Actionable projects that can be top-level or nested in a Folder.
• Todos: Granular actionable steps. Every Todo MUST have a parent Task.

🤖 Intelligence & Mapping (For Agents)

User Intent	Agent Workflow	Endpoint Goal
"Plan a project"	Create Folder -> Tasks -> Todos	POST /folders, POST /tasks, POST /todos
"Fix my mistake"	Fetch History -> Target ID -> Undo	GET /api/v1/undo, POST /api/v1/undo?id=...
"Show my day"	Fetch Todos by Date Range	GET /api/v1/todos?from=...&to=...
"Check settings"	Fetch User Profile & Schedule	GET /api/v1/me
"Surgical Edit"	Patch update a specific record	PATCH /api/v1/{type}?id=...
"Manage Links"	Create or update booking links	POST/PATCH /api/v1/availability/links
"Review Appts"	Accept or decline appointments	PATCH /api/v1/appointments/{id}

🛠️ Execution Logic (The "Omni" Way)

1. Surgical Extraction & Patching: Always prefer fetching a specific record by its ID (GET ?id=...) over broad list fetches. When updating, use PATCH with the record ?id=.
2. Phase-Aware Scheduling: Be mindful of the 5-phase Omni processing loop. Proactively flag events with isProtectedTime: true to trigger the server-side safety net. Use ignoreConflicts: true only when explicit user intent overrides overlap protection.
3. Appointment Awareness: Be extremely cautious when deleting or rescheduling items where isBooked: true. This triggers automatic guest notifications/cancellations. Confirm with the user before performing destructive actions on booked slots.
4. Efficiency & Throttling: Respect the 100 requests per minute rate limit. For bulk operations, batch requests appropriately and check X-RateLimit-Remaining headers.
5. Pagination: When listing folders, tasks, or todos, use limit and offset for large datasets.
6. Scheduling Alignment: Before blocking large segments of time or creating new recurring todos, use GET /api/v1/me to align with the user's weeklySchedule, timezone, and minimumNotice preferences.
7. Cascading Safety: Be aware that deleting a Folder or Task is an Atomic Purge. However, the engine protects items that are simultaneously being updated from accidental deletion.
8. Temporal Fidelity: When reporting event times to the user, strictly respect the user's timezone and local time offset (e.g., CDT vs. CST). Provide dates and times exactly as they appear in the local context or as explicitly requested, without performing unsolicited manual shifts. Use the /me endpoint to confirm the active offset before finalizing any scheduling summaries.
9. Global Availability Awareness: Before modifying booking links or schedules, use GET /api/v1/availability to retrieve the current weeklySchedule, timezone, and minimumNotice settings.
10. Undo/Redo Competency: If a destructive operation is performed in error, use the Undo stack (POST /api/v1/undo) to restore state.

🔒 Security & Privacy (Zero Trust)

• Data Isolation: Strict row-level security; users only see their own data.
• AI Privacy: Your personal data is never used to train models.

📖 Deep References

• Full API Reference: API DOCs
• Omni Architecture: (Located in references/architecture.md)
• Security Audit Docs: SECURITY