Security audit
Security checks across malware telemetry and agentic risk
This is a mostly coherent todo/reminder skill, but it needs Review because it persists chat and cron state and still contains unsafe shell-based cron deletion paths despite claiming that issue was fixed.
Review before installing. Use it only if you are comfortable storing todo data, copied attachments, reminder metadata, and chat routing under OpenClaw memory, and with reminders/status lists being sent through the configured OpenClaw channel. The shell=True cron cleanup code should be fixed before broad use, especially on systems where local reminder files could be edited or shared.
# 删除所有关联的 cron 任务
for job_id in reminders[reminder_name].get("job_ids", []):
try:
subprocess.run(f"openclaw cron delete {job_id}", shell=True, capture_output=True)
except:
passif reminder_name in reminders:
for old_job_id in reminders[reminder_name].get("job_ids", []):
try:
subprocess.run(f"openclaw cron delete {old_job_id}", shell=True, capture_output=True)
except:
pass# 删除旧的 cron 任务
for job_id in new_reminder.get("job_ids", []):
try:
subprocess.run(f"openclaw cron delete {job_id}", shell=True, capture_output=True)
except:
pass# 先删除旧的 cron
for job_id in old_reminder.get("job_ids", []):
try:
subprocess.run(f"openclaw cron delete {job_id}", shell=True, capture_output=True)
except:
pass
old_reminder["job_ids"] = []```bash # 创建项目 python3 todo.py project create "标签" "项目名称" [-d "描述"] # 列出项目 python3 todo.py project list
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.