by 下载技能包
最后更新
2026/4/1
安全扫描
OpenClaw
可疑
medium confidenceThe skill's description says it persists todo.json in the local skill workspace, but the included Python script writes to a hardcoded absolute path (/home/openclaw/...), which is an incoherent and potentially risky mismatch.
评估建议
This skill appears to be a legitimate todo manager, but it's inconsistent: the documentation says todo.json will live in the skill/current directory (references/todo.json), while the script writes to /home/openclaw/.openclaw/workspace/backtest/todo.json. Before installing or running: 1) Do not run it as-is on a machine where /home/openclaw/... might exist and contain important data. 2) Inspect and edit scripts/todo_manager.py to point TODO_FILE to a safe, relative path (for example ./references/...详细分析 ▾
⚠ 用途与能力
SKILL.md describes a simple, local todo.json stored in the skill's references/ directory (or current directory). The shipped script instead uses a hardcoded TODO_FILE = "/home/openclaw/.openclaw/workspace/backtest/todo.json". This does not match the stated default path and indicates the code will read/write outside the skill bundle (and possibly overwrite or create files in an unexpected user home path).
ℹ 指令范围
SKILL.md instructs agents to run the script for add/check/list/done/etc and implies use of references/todo.json and optional push-to-IM in heartbeats. The script implements add/check/list/done operations but: (a) ignores the references/todo.json shipped in the package (because of the hardcoded path), and (b) does not itself implement network push to QQ/IM (it only prints to stdout). The runtime instructions therefore assume a different file layout/behavior than the code actually uses.
✓ 安装机制
No install spec or external downloads; the skill is instruction+script only. No packages or remote installs are performed.
⚠ 凭证需求
The skill declares no required env vars or config paths, but the script requires filesystem write access and uses a hardcoded absolute path under /home/openclaw/.openclaw/... rather than a relative path or configurable location. That is disproportionate to the stated purpose (which implied local skill-scoped storage) and could unintentionally read/modify files in a host user's home.
ℹ 持久化与权限
The skill persists data to disk (normal for a todo tool). It does not request elevated platform privileges nor set always:true. The main issue is the persistence location (absolute path) which gives broader filesystem presence than the docs imply.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/4/1
v1.2.0: --add强制校验deadline格式，--done自动归档30天，新增--archive/--purge
● 无害
安装命令
点击复制官方npx clawhub@latest install task-memory
镜像加速npx clawhub@latest install task-memory --registry https://cn.longxiaskill.com