taskwarrior

Workspace-local task management powered by Taskwarrior. Add, organize, and track tasks by project, tags, due dates, and priority with all data stored inside...

Security Scan

The skill is a narrow, workspace-scoped wrapper around the Taskwarrior CLI and its requirements and instructions are consistent with that purpose.

Purpose & Capability

Name and description match the requested artifact: the skill requires the 'task' (Taskwarrior) binary and performs only Taskwarrior operations scoped to the active workspace. Requested binaries and declared capabilities are proportional to the stated task-management purpose.

Instruction Scope

SKILL.md instructs only Taskwarrior commands and workspace-local file operations (creating .openclaw/taskwarrior/, writing a taskrc there, using TASKRC/TASKDATA env vars). It does not read unrelated system files or exfiltrate data to external endpoints. It explicitly forbids writing global ~/.task unless explicitly requested.

Install Mechanism

No bundled code is present; install metadata references package managers (brew/apt) which is reasonable for obtaining the Taskwarrior binary. The skill itself states it will not perform runtime installs. This is coherent for a CLI-wrapper skill, though there is a small metadata mismatch (SKILL.md metadata includes apt and brew, while registry install spec lists only brew) — a minor documentation inconsistency, not a security issue.

Credentials

The skill requires no credentials or sensitive environment variables. It optionally reads standard workspace-related env vars (OPENCLAW_WORKSPACE, WORKSPACE, PROJECT_DIR, REPO_ROOT) to resolve the workspace root — reasonable and scoped. No unexpected secrets or unrelated services are requested.

Persistence & Privilege

always:false and no modifications to other skills or system-wide settings. The skill writes only to the workspace-scoped .openclaw/taskwarrior/ area (its own data), which is appropriate for a task-management skill. Autonomous invocation is the platform default but is not in itself a red flag here.

Assessment

This skill is a thin wrapper around the Taskwarrior CLI and appears to be what it claims: it requires the 'task' binary and will store all data under <workspace>/.openclaw/taskwarrior/. Before installing/use: 1) Ensure you trust the environment image (that 'task' is the official Taskwarrior binary). 2) Confirm you are comfortable with the skill writing task state into the workspace directory (it will not touch your global ~/.task or ~/.taskrc unless you explicitly ask). 3) If you do not want the agent to perform writes autonomously, consider restricting autonomous invocation or making the skill user-invocable only. 4) Note the small metadata mismatch around install options (apt vs brew) — confirm your runtime provides Taskwarrior rather than relying on the skill to install it.

Taskwarrior (Workspace-Local Tasks) — AgentSkill

Skill name

taskwarrior

Purpose

Manage tasks using Taskwarrior as the backend with data stored inside the current workspace. This skill provides a safe, workspace-scoped wrapper for common Taskwarrior operations (add/list/modify/done/projects/tags/due/priority/annotations).

Runtime requirements (ClawHub)

This skill requires Taskwarrior to already be available in the runtime environment (e.g., included in the base image).

• Validation: run task --version
• If missing: report the dependency and instruct the environment owner to install system package taskwarrior (some distros package it as task).

This skill does not perform system-level installs (no apt, brew, dnf, etc.).

Workspace root resolution (portable)

The skill resolves the workspace root at runtime:

1. If set, use the first available of:
   • OPENCLAW_WORKSPACE
   • WORKSPACE
   • PROJECT_DIR
   • REPO_ROOT
2. Otherwise, fallback to the current working directory.

All Taskwarrior data is stored under: <workspace>/.openclaw/taskwarrior/

Workspace-local Taskwarrior home

• taskrc: <workspace>/.openclaw/taskwarrior/taskrc
• data dir: <workspace>/.openclaw/taskwarrior/.task/

Every Taskwarrior command MUST run with:

• TASKRC=<workspace>/.openclaw/taskwarrior/taskrc
• (optional) TASKDATA=<workspace>/.openclaw/taskwarrior/.task

Never write to global ~/.task or ~/.taskrc unless the user explicitly asks to use global storage.

Core workflow

1. Check dependency

   • Run: task --version
   • If missing: stop and return dependency instructions (see references/clawhub_notes.md).

2. Initialize workspace storage

   • Ensure directories exist:
     • <workspace>/.openclaw/taskwarrior/
     • <workspace>/.openclaw/taskwarrior/.task/
   • Ensure <workspace>/.openclaw/taskwarrior/taskrc contains at least:
     • data.location=<workspace>/.openclaw/taskwarrior/.task
     • confirmation=off
     • verbose=off

3. Execute requested operations

   • Prefer stable/common commands (see references/taskwarrior_cheatsheet.md).

4. Verify results

   • After any mutation, show a focused task <id> info or filtered task <filter> list.

Supported operations (useful subset)

• Add tasks: task add ...
• List tasks: task list, task <filter> list
• Modify tasks: task <id> modify ...
• Complete tasks: task <id> done
• Start/stop: task <id> start|stop (if desired)
• Projects/tags: task projects, task tags, project:<name>, +tag, -tag
• Due/priorities: due:<date>, priority:H|M|L
• Notes: task <id> annotate "..."

Safety

Follow references/safe_command_policy.md. Highlights:

• No delete/purge unless explicitly requested.
• Avoid broad bulk changes without previewing the matching set.
• No global config writes by default.

References

• references/workspace_data_layout.md
• references/taskwarrior_cheatsheet.md
• references/safe_command_policy.md
• references/examples.md
• references/clawhub_notes.md