Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

taskleef

Use when managing todos, tasks, projects, or kanban boards via Taskleef.com. Supports adding, listing, completing, deleting todos, organizing with projects, and managing kanban boards. Use when the user wants to track tasks, manage their todo list, organize work by projects, or use kanban workflows.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 1.7k · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, required binaries (todo, curl, jq), and required env var (TASKLEEF_API_KEY) all align with a CLI-based integration for Taskleef.com. The only minor metadata mismatch is that registry metadata lists no homepage while the SKILL.md includes https://taskleef.com, but this does not affect capability alignment.
Instruction Scope
SKILL.md instructs the agent to call the todo CLI and describes CLI flags and expected behavior. It does not instruct reading unrelated files or environment variables beyond TASKLEEF_API_KEY, and only mentions an optional auth file (~/.taskleef.auth) which is reasonable for storing credentials.
Install Mechanism
The install spec will download a single 'todo' executable from raw.githubusercontent.com (Xatter/taskleef) and provides jq via Homebrew or GitHub releases. Downloads come from GitHub hosts (known/common) rather than unknown personal servers, but installing an executable fetched from a raw GitHub URL is a higher-risk operation than using a vetted package — users should review the binary/script before making it executable.
Credentials
Only TASKLEEF_API_KEY is required and declared as the primary credential; that matches the stated purpose. The skill suggests an optional auth file and storing an API key in the agent config, which are reasonable. No unrelated credentials or excessive environment access are requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills' configs or system-wide settings beyond suggesting where to store an API key in the user's Clawdbot config (normal for skill configuration).
Assessment
This skill appears coherent for managing Taskleef todos, but take these precautions before installing: - Verify that https://taskleef.com is the legitimate service you expect. - Inspect the 'todo' file the installer downloads from raw.githubusercontent.com before running chmod +x; raw GitHub content can be arbitrary code. Prefer installing from an official release repository or building from source when possible. - Keep TASKLEEF_API_KEY secret: store it in the agent config or an auth file with restrictive permissions (e.g., chmod 600), and do not commit it into dotfiles or public repos. - Expect the todo CLI to make network requests to Taskleef APIs (normal for this skill); if you need tighter control, run the CLI in a constrained environment or review network activity. If you want extra assurance, ask the skill author for an official release URL or published package and for the source repository for the todo CLI so you can review it before installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk9787vjetvweek2v89hnktge2x800r48

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Clawdis
Binstodo, curl, jq
EnvTASKLEEF_API_KEY
Primary envTASKLEEF_API_KEY

Install

Install jq via Homebrew
Bins: jq
brew install jq

SKILL.md

Taskleef

Manage todos, projects, and kanban boards using the Taskleef CLI. Taskleef.com is a flexible todo application that supports simple task lists, project organization, and kanban board workflows.

Prerequisites

The todo CLI requires:

  • curl - for making API requests
  • jq - for parsing JSON responses
  • TASKLEEF_API_KEY environment variable

Authentication

The CLI uses the TASKLEEF_API_KEY environment variable. Users can get their API key from https://taskleef.com.

Optionally, users can use --auth-file flag to specify an auth file:

todo --auth-file ~/.taskleef.auth list
todo -a ~/.taskleef.auth list

Core Commands

Todo Management

List todos:

todo list           # List pending todos
todo ls             # Alias for list
todo list -a        # List all todos including completed

Add todos:

todo add "Buy groceries"
todo "Buy groceries"    # Quick add without 'add' keyword

Show todo details:

todo show <title-or-id>

Complete todos:

todo complete <title-or-id>
todo done <title-or-id>

Delete todos:

todo delete <title-or-id>
todo rm <title-or-id>

View inbox:

todo inbox    # List todos not assigned to any project

Subtasks

Add subtasks:

todo subtask <parent-title-or-id> "Subtask title"

Projects

List projects:

todo project list

Create project:

todo project add "Project Name"

Show project details:

todo project show <project-name-or-id>

Delete project:

todo project delete <project-name-or-id>

Add todo to project:

todo project add-todo <project-name-or-id> <todo-title-or-id>

Remove todo from project:

todo project remove-todo <project-name-or-id> <todo-title-or-id>

Kanban Boards

Show board:

todo board                           # Show default board (ASCII view)
todo board show <board-name-or-id>   # Show specific board

List boards:

todo board list

List column cards:

todo board column <column-name-or-id>

Move card:

todo board move <card-title-or-id> <column-name-or-id>

Mark card done:

todo board done <card-title-or-id>

Assign card:

todo board assign <card-title-or-id>

Clear column:

todo board clear <column-name-or-id>

Identifier Matching

Commands accept:

  • ID prefix: First few characters of UUID (e.g., abc12)
  • Title match: Partial, case-insensitive title match (e.g., groceries matches "Buy groceries")

Priority Indicators

When listing todos, you'll see:

  • ○ No priority
  • ● (green) Low priority
  • ● (yellow) Medium priority
  • ● (red) High priority

Usage Tips

  1. Finding items: You can reference todos, projects, boards, columns, and cards by partial title or ID prefix
  2. Quick workflow: Use todo "task" for fast task entry
  3. Project organization: Group related todos under projects for better organization
  4. Kanban boards: Use boards for visual workflow management
  5. Subtasks: Break down complex tasks into subtasks for better tracking

Examples

# Add and complete a todo
todo add "Review pull request"
todo done "pull request"

# Create a project and add todos
todo project add "Website Redesign"
todo project add-todo "Website" "Fix login"

# View kanban board and move cards
todo board
todo board move "Feature A" "Done"

Error Handling

If the TASKLEEF_API_KEY is not set or invalid, commands will fail. Ensure the API key is configured before running commands.

Additional Resources

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…