Claw List

Manage todo lists in PostgreSQL. Per-agent lists, optional categories, priorities, due dates. Triggers: "todo", "add task", "mark done", "what's due", "my ta...

Security Scan

The skill largely does what it says (manage per-agent todo lists via an HTTP API), but it explicitly instructs the agent to store conversation context on a remote service and bundles an unauthenticated server stack — behaviour that can leak sensitive conversation data if the remote API is untrusted.

Purpose & Capability

Name/description (todo lists backed by Postgres via a central API) matches the included API docs and server code. Minor mismatch: SKILL.md and overview sometimes present the skill as an 'instruction-only' skill, yet a full server/stack is bundled in the repo — this is explained in docs (server/ included for self-hosting) but the registry metadata declared 'No install spec' which may mislead users about the presence of runnable server code.

Instruction Scope

SKILL.md instructs the agent to store 'conversation context' in the items.notes field when the user requests 'put that in the notes'. That means agent text (potentially sensitive) is intentionally transmitted to and persisted on an external HTTP service. The runtime steps also include writing a local conf and self-registering with POST /admin/agents. Reading/writing the conf in the skill directory is scoped, but the explicit remote storage of conversation text is a notable scope expansion from a simple local todo helper.

Install Mechanism

No install spec is provided and the skill runs via instructions / existing binaries on the agent; nothing is automatically downloaded or executed on install. The repository does include server code and Docker Compose for self-hosting, but those are optional manual deployment artifacts (not auto-installed by the agent).

Credentials

The agent-side skill requests no credentials (CLAW_LIST_URL and optional CLAW_LIST_AGENT_ID are provided by the user or openclaw.json). However, the skill's documented behaviour of storing conversation context remotely is disproportionate for a 'todo list' helper unless the user explicitly accepts remote persistence. Additionally, the bundled server's admin endpoints are documented as unauthenticated (no X-Agent-Id required) and the README notes 'Auth — no authentication currently' as a known gap; if the server is exposed to an untrusted network this becomes a significant risk to confidentiality and integrity of agent data.

Persistence & Privilege

The skill does not request 'always: true' and allows normal model invocation. Autonomous invocation (default) combined with the explicit instruction to persist conversation context remotely increases blast radius if the agent is allowed to run actions without user oversight. There is no indication the skill modifies other skills or system-wide configs.

What to consider before installing

Before installing or enabling this skill: - Understand where CLAW_LIST_URL points. The skill will send conversation text to that URL (it stores 'conversation context' in the remote item's notes). Only use a CLAW_LIST_URL you control and trust (prefer an internal host on a private network or deploy the provided server locally). - The bundled server currently advertises no authentication for admin endpoints and documents 'no auth' as a known gap — if you deploy it, do so behind an authenticated reverse proxy or on an isolated network. - If you do not want any conversation content sent off the agent host, do not enable the feature that saves notes, or do not use this skill. - Consider limiting autonomous invocation for this skill (require explicit user invocation) while you audit and test it, and review the server code (server/api/main.py) if you plan to host the backend. - If unsure, deploy the server in a safe sandbox, exercise the endpoints, and verify that agent data is stored only where you expect before using it with real conversations.

Manage todo lists via a central API. Trigger on: "the list", "show me the list", "todo", "add task", "add to my list", "mark done", "mark complete", "what's due", "my tasks", "create a list".

Config

Check env vars first: CLAW_LIST_AGENT_ID, CLAW_LIST_URL (set via openclaw.json skills.entries for multi-agent setups).

If env vars not set: read ~/.openclaw/skills/claw-list/claw-list.conf and extract AGENT_ID, DISPLAY_NAME, CLAW_LIST_URL, REGISTERED.

If conf file doesn't exist (first run):

1. Generate UUID: cat /proc/sys/kernel/random/uuid — fallback: python3 -c 'import uuid; print(uuid.uuid4())'
2. Ask user for DISPLAY_NAME and CLAW_LIST_URL (e.g. https://claw-list.internal/api or http://host:8100)
3. Write conf file with those values and REGISTERED=false

If REGISTERED=false: call POST {CLAW_LIST_URL}/admin/agents with body {"agent_id":"{AGENT_ID}","display_name":"{DISPLAY_NAME}","scope":"own"} — no X-Agent-Id header. On 201 or 409 write REGISTERED=true to conf. On any other status: tell user the API is unreachable and stop.

API

All requests require header X-Agent-Id: {AGENT_ID}. Base URL from CLAW_LIST_URL.

Lists: GET /lists · POST /lists {"name":"..."} · DELETE /lists/{id}

Items: GET /lists/{id}/items · POST /lists/{id}/items · PUT /items/{id} · DELETE /items/{id}

Item fields: title (required on create), notes, priority (1–5), due_date, category, done.

Full reference: ~/.openclaw/skills/claw-list/docs/api.md

Behaviour

• Re-read conf at the start of every session — never assume values from a previous session.
• Present results cleanly; never expose AGENT_ID or raw JSON to the user.
• Store conversation context in notes when the user says "put that in the notes".
• On 403: tell the user they don't have permission, don't retry.