autonomous-tasks

Self-driven AI worker. Reads goals, generates tasks, executes, and logs progress. Keywords: create goal, new goal, set goal, run goals, 创建目标, 新目标, 设定目标, 执行目标.

Security Scan

The skill's stated purpose (autonomous task runner) aligns with its files, but the runtime instructions are vague about how tasks are 'executed' and allow broad filesystem and autonomous action, which is disproportionate and could be abused without further constraints.

Purpose & Capability

Name/description match the SKILL.md: it reads goals, generates tasks, executes them, and logs progress in an agents/ directory. No unrelated environment variables or external dependencies are requested. However, 'execute tasks' is under-specified — legitimate implementions might only operate on text files, but the instructions permit arbitrary task execution and writing outputs to the current working directory, which is broader than a simple task-planning helper.

Instruction Scope

The SKILL.md explicitly instructs the agent to read and write files under agents/ (relative to the skill) and to 'execute tasks' from memory/tasks.md, but it does not define what executing a task entails or limit allowed actions (shell commands, network calls, API keys, etc.). It also recommends installing a scheduled cron job (openclaw cron add). The guidance to never write into the skill dir but allow arbitrary outputs to the current working directory grants broad write/read scope that could touch sensitive locations if the working directory is not sandboxed.

Install Mechanism

Instruction-only skill with no install spec and no code files — minimal install risk. Nothing is downloaded or written by an installer step.

Credentials

The skill requests no environment variables or credentials, which is proportionate. It does, however, expect persistent filesystem access to create and maintain an agents/ directory adjacent to SKILL.md and to write outputs to the working directory; those filesystem privileges may be more than a user expects from a 'task generator' and should be considered when granting runtime permissions.

Persistence & Privilege

always:false (good) and the skill is user-invocable. It recommends creating a scheduled cron entry via openclaw, which would make it run periodically if the user sets that up. Because disable-model-invocation is false (the platform default), the skill could act autonomously when invoked — combine this with vague execution semantics and persistent storage and the blast radius increases.

What to consider before installing

This skill appears to do what it says (run self-driven tasks), but its runtime instructions are too vague about what 'execute tasks' means. Before installing or scheduling it: (1) Review or create agents/AUTONOMOUS.md, agents/memory/tasks.md and backlog to ensure no sensitive goals or commands are present. (2) Run the skill in a restricted/sandboxed environment (isolated working directory, no access to secrets, limited network) to observe what it does. (3) Do not enable the suggested cron schedule until you trust the behavior. (4) Ask the author or update SKILL.md to explicitly constrain what kinds of task execution are allowed (e.g., only edit files, no shell commands, whitelist network domains, require explicit user confirmation for external actions). (5) Avoid placing the skill's working directory somewhere that contains secrets or production data. These steps will reduce risk from its broad, under-specified execution powers.

Read goals → Generate tasks → Execute → Log → Stop

You are a self-driven AI worker. Each time you are woken up, execute one round of tasks, then stop.

All user data lives in agents/ relative to this SKILL.md file's directory (i.e. the same directory that contains this SKILL.md). This data is preserved across normal skill updates (only SKILL.md and _meta.json are overwritten).

Workflow

0. Initialize (first-time only)

If agents/ does not exist (relative to this SKILL.md's directory):

1. Ask the user for their goals
2. Read assets/templates.md and create all files in agents/
3. Strongly recommend the user to set up scheduled execution:

   openclaw cron add --name "autonomous-tasks" --message "run autonomous tasks" --every 1h
   

4. Stop immediately. Do not continue to the next steps. Wait for the next wake-up.

1. Read Goals

Read the following files from agents/ (relative to this SKILL.md's directory):

• agents/AUTONOMOUS.md — long-term goals + current todos
• agents/memory/backlog.md — backlog ideas
• agents/memory/tasks.md — unfinished tasks from a previous run

If current todos are empty, check milestones:

1. If there are unchecked milestones [ ]: take the next one, decompose it into concrete todos, write them into the "Current Todos" section of AUTONOMOUS.md, then continue
2. If all milestones are done: prompt the user to set new goals. Give 2-3 example directions based on project context. Once the user has set new goals, clean up old state:
   • Clear completed milestones from AUTONOMOUS.md
   • Clear memory/backlog.md
   • Clear memory/tasks-log.md
   • Do not invent goals. If the user doesn't respond, stop and wait

2. Generate Tasks

If memory/tasks.md has unfinished tasks, resume execution without regenerating.

If no unfinished tasks, generate new tasks from todos and write to memory/tasks.md:

- [ ] task description
- [ ] task description

Rules:

• Prioritize AUTONOMOUS.md current todos first, then backlog.md
• Split into reasonable granularity, each task must have a clear output
• All outputs go to the current working directory, never into the skill directory or agents/
• Keep outputs from different goals and milestones separated

3. Execute Tasks

Execute tasks in order from memory/tasks.md.

Mark as in progress:

- [~] task description

Mark as done:

- [x] task description → output path

If execution fails, mark and skip:

- [!] task description → failure reason

Do not retry failed tasks.

If you discover new ideas or follow-up work during execution that is not part of the current task, add it to memory/backlog.md instead of acting on it immediately.

4. Archive

When all tasks in memory/tasks.md are marked ([x] or [!]):

1. Append results to memory/tasks-log.md:

- ✅ description → output path (YYYY-MM-DD)
- ❌ description → failure reason (YYYY-MM-DD)

2. Clear memory/tasks.md (keep the heading)
3. Remove completed items from AUTONOMOUS.md or backlog.md
4. If all current todos are cleared, mark the corresponding milestone as [x]
5. When tasks-log.md exceeds 50 lines, keep only the most recent 30

5. Stop

After archiving, stop immediately. Do not generate new tasks. Do not loop. Wait for the next wake-up.

Reference

Before starting, read assets/rules.md (same directory as this SKILL.md) for prohibited actions, core principles, and file structure.