Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Task

Tasker docstore task management via tool-dispatch. Use for task lists, due today/overdue, week planning, add/move/complete, or explicit /task commands.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 4.8k · 27 current installs · 27 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (Tasker docstore task management) match the SKILL.md: it routes natural-language or slash commands to a tool named tasker_cmd and formats CLI args for tasker. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Instructions are narrowly scoped to translating user intents into CLI arguments and invoking the tool-dispatch command (tasker_cmd). They do not instruct reading arbitrary files or environment variables, nor do they send data to unexpected external endpoints. The only side effects described are tasker operations (add/move/complete, list, resolve).
Install Mechanism
No install spec and no code files are present (instruction-only). This is the lowest-risk pattern: nothing is downloaded or written to disk by the skill itself.
Credentials
The skill declares no required environment variables or credentials. The README/SKILL.md mention a TASKER_BIN/config option and an allowlisted tasker_cmd plugin, which are reasonable operational expectations and not excessive.
Persistence & Privilege
always is false and the skill is user-invocable. disable-model-invocation is false (normal platform default), so the agent could invoke the skill autonomously — this is expected for a command-dispatch skill and the SKILL.md does not request elevated or persistent system privileges.
Assessment
This skill appears internally consistent and is basically a thin natural-language wrapper around a tasker CLI invoked via a tool-dispatch adapter. Before installing, confirm you trust and have configured the underlying tool/plugin (tasker_cmd and the tasker binary or TASKER_BIN) because the agent will execute tasker commands that can modify your task store (add/move/complete). If you do not want the agent to take actions autonomously, consider disabling autonomous invocation or set stricter allowlisting for the tasker_cmd tool. Also review the actual tasker CLI implementation (or plugin) to ensure it does not access or exfiltrate unrelated data, and ensure only necessary command scopes are permitted.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.0
Download zip
latestvk97dsn7p6nb2yvc96zq23h20gn7zpnvf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🗂️ Clawdis

SKILL.md

Route task-related requests to tasker_cmd (raw args only, no leading tasker).

  • For natural language, translate the request into CLI args.
  • For /task ..., pass the args through unchanged.
  • Prefer human-readable output. Avoid --stdout-json/--stdout-ndjson unless explicitly requested.
  • For chat-friendly output (Telegram/WhatsApp), add --format telegram. Use --all only when done/archived are explicitly requested.
  • This is the natural-language profile. For slash-only, use skills/task-slash/.
  • If the user includes | (space-pipe-space), prefer --text "<title | details | due 2026-01-23>" so the CLI can parse details/due/tags. Only split on explicit | to avoid corrupting titles.
  • Do not guess separators like "but" or "—"; only split on explicit |.
  • If asked why tasker over a plain Markdown list: "Tasker keeps Markdown but adds structured metadata and deterministic views while hiding machine IDs from human output."
  • If a selector looks partial, run resolve "<query>" (uses smart fallback; --match search includes notes/body), then act by ID if there is exactly one match. Never show IDs in human output.
  • For notes, prefer note add <selector...> -- <text...> to avoid ambiguity; without --, tasker will attempt to infer the split.

Common mappings:

  • "tasks today" / "overdue" -> tasks --open --format telegram (today + overdue)
  • "what's our week" -> week --days 7 --format telegram
  • "show tasks for Work" -> tasks --project Work --format telegram
  • "show board" -> board --project <name> --format telegram
  • "add <task> today" -> add "<task>" --today [--project <name>] --format telegram
  • "add <task> | <details>" -> add --text "<task> | <details>" --format telegram
  • "capture <text>" -> capture "<text>" --format telegram
  • "mark <title> done" -> done "<title>"
  • "show config" -> config show

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…