Task Tracker

This skill generally does what it says (maintains a persistent task-state file), but it instructs the agent to persist session IDs, PIDs, server names and the exact commands for background/SSH work — these can contain secrets. Before installing, consider: - Confirm whether the skill will actually run automatically; if automatic invocation is intended, the registry should set always:true or otherwise document how auto-triggering is enforced. If not intended, update SKILL.md to avoid surprise behavior. - Ask where memory/tasks.md is stored, who can read it, and whether it is synced off-device. Ensure appropriate access controls and encryption are in place. - Require the skill to redact or avoid storing command-line arguments that may contain credentials (e.g., mask tokens/ passwords) or record only sanitized metadata (e.g., command name, not full args). - Prefer prompting the user for explicit consent before recording SSH/server details or before the first automatic write. - If you cannot verify storage protections or sanitization, treat this skill as higher risk and avoid installing it in environments that handle secrets or sensitive infrastructure. If the author can provide: where the file is stored, assurance of access controls/encryption, and a change to the SKILL.md that either removes automatic-trigger language or the registry is updated to reflect true automatic behavior, this would reduce concern.