Get To It
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a purpose-aligned local task manager, but it persistently stores personal productivity data and optional calendar data on your machine.
This skill looks reasonable for a local personal task secretary. Before installing, understand that it creates a persistent local database, may automatically remember personal preferences or constraints, and can store calendar event data if you connect an iCal URL.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Saying common phrases like “done” or “skip” can update the local task database.
The agent is instructed to convert natural-language phrases into local CLI actions that can change the task database. This is central to the skill's purpose, but users should know those actions may be taken immediately.
Detect these and take the corresponding action immediately: ... done / finished [task] → complete TASK_ID ... skip → skip TASK_ID ... connect calendar → connect-calendar NAME "URL"
Use clear task names and ask the assistant to confirm ambiguous updates if you do not want automatic local task changes.
Preferences, constraints, and personal insights you mention may be saved locally and reused in later recommendations.
The skill intentionally stores long-term personal context for future use. This is purpose-aligned, local, and disclosed in the skill instructions, but it is persistent and does not require a separate user approval each time.
Store important personal patterns silently. If the user reveals a lasting preference, constraint, or insight ... call `store-ltm` without asking.
Avoid sharing sensitive personal details you do not want remembered, and use the listed `list-ltm` and `clear-ltm` commands to review or delete stored memories.
If you connect a calendar, event details and the calendar source URL may be stored in the local database, and the calendar provider will receive fetch requests.
The CLI supports fetching calendar data from a user-provided iCal URL and storing synced events. This is expected for scheduling, but calendar URLs and events can be sensitive.
connect-calendar NAME URL Register an ical calendar source sync-calendar [--id N] Sync calendar events for today
Only connect trusted calendar URLs, treat private iCal links like secrets, and disconnect calendars you no longer need.
Version mismatch can make it harder to know exactly which release you are reviewing or installing.
The registry metadata lists Version: 1.0.0 while the SKILL.md frontmatter shows 2.0.0. This is a minor provenance/versioning inconsistency, not evidence of malicious behavior.
version: 2.0.0
If provenance matters to you, verify the package against the linked homepage or repository before installing.