by 安全扫描
OpenClaw
可疑
medium confidenceThe skill largely does what it says (manage a TASKS.md file) but contains a few coherence issues — notably a hardcoded user-specific default path and implicit filesystem write behavior that aren't declared — so review before installing.
评估建议
This skill appears to be a simple local task tracker that will create and update a TASKS.md file. Before installing: 1) Confirm where it will store TASKS.md — change the hardcoded path to a workspace-relative path to avoid writing into an unexpected home directory. 2) Review and run scripts/update-task-stats.js yourself to verify no unexpected behavior; it only reads/writes the provided file path but you should inspect it. 3) Ensure the agent is allowed to write to the chosen file and consider b...详细分析 ▾
ℹ 用途与能力
The name/description match the provided instructions and included script: the skill maintains a TASKS.md and updates statistics. Nothing in the package requests unrelated credentials or network access. However, the SKILL.md uses a hardcoded default file path (/Users/quenflysmac/.openclaw/workspace/TASKS.md) which is user-specific and odd for a generic skill; the package metadata does not declare any required config paths even though the skill expects to read/write a workspace file.
⚠ 指令范围
Runtime instructions require creating, reading and writing a TASKS.md file in the user's workspace and mandate automatic recording of new tasks (within 5 minutes). Those file I/O operations are within the stated purpose, but the SKILL.md gives a specific absolute path tied to a particular user account instead of a generic workspace location and does not instruct about permissions, backups, or confirming writes with the user — giving the skill automatic write duties that may surprise users.
✓ 安装机制
No install spec or external downloads; the skill is instruction-only and includes a small local Node script (scripts/update-task-stats.js) that reads/writes the TASKS.md file. No network fetches or archive extraction are present.
⚠ 凭证需求
The skill declares no required environment variables or config paths, yet its runtime behavior expects filesystem access to a specific path under a user's home. The lack of declared config/permission requirements is a mismatch — the skill needs write/read permission to the workspace but does not document or request that explicitly.
✓ 持久化与权限
The skill is not set to always:true and does not request elevated platform privileges. It will autonomously update a local file when invoked, which is consistent with its purpose. It does not modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/29
Initial release of Task Manager skill — a system for recording, tracking, and managing assistant tasks. - Automatically maintains a detailed task log, including persistent and one-time tasks - Supports task status updates, system function calls, permission requirements, and software dependencies - Enables querying and statistics on tasks by type, status, time, and keywords - Saves all records to a configurable TASKS.md file; includes auto-generated headers and statistics - Includes a script (update-task-stats.js) to recalculate and update task statistics
● 无害
安装命令
点击复制官方npx clawhub@latest install task-manager-easy
镜像加速npx clawhub@latest install task-manager-easy --registry https://cn.longxiaskill.com