by 安全扫描
OpenClaw
安全
high confidenceThe skill is internally consistent: it only documents and manipulates local TODO/DONE files under memory/todo and requires no credentials, installs, or external network access.
评估建议
This skill appears to do only what it says: manage TODO and DONE files under memory/todo. Before installing, decide whether you are comfortable with an autonomously-invoked agent editing those files (the spec encourages proactive updates). If you prefer manual control, disable autonomous invocation for the skill or review/backup the memory/todo folder. Also ensure memory/todo does not contain sensitive data you wouldn't want the agent to write or expose.详细分析 ▾
✓ 用途与能力
The name/description (TODO list management) matches the instructions and references: all actions are file-based operations on memory/todo/TODO.md and memory/todo/DONE.md. There are no unrelated environment variables, binaries, or network endpoints requested.
ℹ 指令范围
Runtime instructions are limited to reading, creating, and editing files under memory/todo (mkdir, touch, cat, manual edit). This is appropriate for a local todo manager. The spec also encourages '主动更新' and '每隔一段时间主动检查' (proactive/periodic checks), which is within scope but somewhat vague and could let an autonomous agent decide when to write/update files — a behavior the user should be aware of.
✓ 安装机制
Instruction-only skill with no install spec and no code files to execute; nothing is downloaded or written to disk by an installer.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The only resource accessed is the local memory/todo directory, which is proportional to the stated purpose.
✓ 持久化与权限
always is false and the skill does not request system-wide changes or other skills' config. Note: the platform default allows autonomous invocation, so the skill could perform the file edits it describes without each explicit user prompt; this is coherent with its '主动更新' guidance but may be undesired by some users.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/20
- Initial release of the todo-list skill for managing tasks (TODO/DONE) separate from daily logs. - Provides clear file formats for TODO.md (待做/进行中) and DONE.md (已完成). - Emphasizes concise, purposeful task recording and proactive status updates. - Includes usage instructions, recording conventions, and sample commands. - Details the difference between task management and daily journaling.
● 无害
安装命令
点击复制官方npx clawhub@latest install openclaw-todo-list
镜像加速npx clawhub@latest install openclaw-todo-list --registry https://cn.longxiaskill.com