Session Task Tracker

Task-based cross-session context management for OpenClaw agents. Maintains persistent task files so context survives session resets, compaction, and channel...

Security Scan

The skill's stated purpose (persist per-task markdown files) matches its instructions, but the runtime guidance encourages keeping sensitive facts/absolute paths in persistent files without any secret-handling guidance — this creates a plausible data-leakage risk and is worth caution.

Purpose & Capability

Name/description match the instructions: the skill only reads/writes per-task markdown files under {workspace}/tasks and maintains an index. No unexpected binaries, environment variables, or external services are requested.

Instruction Scope

Instructions explicitly direct the agent to create, read, update, move, and archive files under {workspace}/tasks and to maintain _INDEX.md. They also encourage storing '关键信息' (configs, links, accounts) and '相关文件' as absolute paths — there is no guidance to avoid or protect secrets, redact credentials, or limit what absolute paths are recorded or read. This can lead to persistent storage of sensitive data and possible accidental exposure across sessions or channels.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer and there are no download URLs to evaluate.

Credentials

The skill requests no environment variables or credentials (proportionate). However, its file format explicitly permits storing 'accounts' and absolute filesystem paths; requiring the agent to persist such data is disproportionate unless the user explicitly consents and secrets are protected. The SKILL.md does not declare or limit access to other files beyond the workspace/tasks tree.

Persistence & Privilege

always is false (normal). The agent is allowed to invoke the skill autonomously (disable-model-invocation false). Combined with automatic file writes across sessions, autonomous invocation increases the risk that the agent will persist or update sensitive info without tight user oversight.

What to consider before installing

This skill appears to do what it says (maintain per-task markdown files), but it encourages storing configuration details, accounts, and absolute file paths in persistent files without any guidance on secret handling. Before installing: (1) Decide whether the workspace/tasks location is an appropriate place to persist sensitive data; avoid putting passwords, API keys, or private keys into task files. (2) If you will record credentials or config, require the skill to redact/avoid secrets or encrypt task files (or store sensitive data in a dedicated secret manager). (3) Restrict filesystem permissions on the workspace so other agents/users can't read task files. (4) Prefer that the skill prompt you before persisting any '关键信息' or absolute paths. (5) If you want tighter control, consider disabling autonomous invocation (if your platform supports it) or request the author add explicit safe-handling guidance (secret redaction, warnings, and an allowlist of paths). If you want, ask the skill author to add: (a) explicit prohibition on storing credentials, (b) optional encryption or secret-store integration, and (c) an explicit confirmation step before writing any 'accounts' or absolute paths.

Task Tracker

Persist task context across sessions and channels by maintaining per-task files.

Core Concept

Each task gets a single markdown file in tasks/. The file IS the memory — independent of session history, compaction, or channel.

When This Skill Fires

Situation	Action
New task/project mentioned	Create task file + update index
Progress/decision on existing task	Update that task file
Session start (bootstrap)	Read _INDEX.md
User references a task	Read that task file, respond with context
User signals leaving ("先这样", "回家再说")	Ensure all discussed tasks are updated

Task Directory

Location: {workspace}/tasks/

tasks/
├── _INDEX.md          # Task index (auto-maintained)
├── project-alpha.md    # One file per task
└── weekly-report.md

Task File Format

# [Task Name]

- **状态：** 进行中 | 暂停 | 待启动 | 已完成 | 已搁置
- **优先级：** 高 | 中 | 低
- **创建时间：** YYYY-MM-DD
- **最后更新：** YYYY-MM-DD
- **标签：** #tag1 #tag2

## 目标
[One sentence: what this task achieves]

## 背景
[Why this task exists, origin context]

## 进展记录
### YYYY-MM-DD
- What was done
- Key decisions made

## 待办
- [ ] TODO item
- [x] Completed item

## 关键信息
[Core facts that must persist: configs, links, accounts, constraints]

## 相关文件
- File description: path/to/file

Rules:

• 进展记录: newest date on top
• 待办: mark done with [x] when complete
• 关键信息: only facts that another session needs to function
• 相关文件: absolute paths, brief description

Index File (_INDEX.md)

# 任务索引

## 🟢 进行中
| 任务 | 状态 | 最后更新 | 优先级 |
|------|------|---------|--------|

## 🟡 暂停
| 任务 | 状态 | 最后更新 | 优先级 |
|------|------|---------|--------|

## ⚪ 已完成
| 任务 | 完成时间 |
|------|---------|

Maintain this file whenever a task's status changes.

Workflow

Creating a New Task

1. Create tasks/{task-name}.md using the template above
2. Add entry to _INDEX.md under 进行中
3. Confirm creation with user

Updating a Task

1. Update 进展记录 (prepend new date entry if new day)
2. Update 待办 (check off completed items)
3. Update 状态 if changed
4. Update 最后更新 timestamp
5. Sync 状态 change to _INDEX.md

Session Bootstrap

1. Read _INDEX.md
2. No user action needed — just be ready
3. When user mentions a task, read that file and respond with current context

Task Completion / Archive

• Move file to tasks/archive/
• Remove from _INDEX.md
• Do this for tasks completed or stalled more than 30 days

File Naming

• Chinese or English, short and clear
• No special characters, use - for spaces
• Max 64 characters