Task Engine

Multi-agent task orchestration engine with state machine tracking. Use when complex multi-step projects need automated monitoring, multi-agent collaboration,...

This skill appears to be what it claims: a local, file-backed multi-agent task engine. Before installing or enabling it: 1) Verify where the skill files will be placed and update SKILL.md hard-coded paths to your environment (the examples use /home/zeron/...). 2) Back up your heartbeat script and test the heartbeat integration in a sandbox before adding the import snippet—the snippet will cause the skill to run every heartbeat and can change index.json/task files. 3) Inspect config/settings.yaml (guild_id, human_user_id, agent workspace roots) and remove or adjust any values you don't want used; the skill does not include Discord tokens, but it formats messages that your agent (Eva) will send via platform tools. 4) Run the bundled tests (pytest) in an isolated workspace to confirm behavior. 5) If you are uncomfortable with periodic autonomous execution, do not modify the heartbeat and invoke the CLI manually instead.

Type: OpenClaw Skill Name: task-engine Version: 1.0.0 The skill is classified as suspicious due to a critical prompt injection vulnerability. The `scripts/engine/dispatcher.py` module's `generate_dispatch_prompt` function constructs prompts for other AI agents (e.g., Claude Code) by directly embedding user-supplied `title` and `description` fields from task and subtask definitions. An attacker with the ability to create or dispatch tasks could inject malicious instructions into these fields, which would then be executed by the downstream agent, potentially leading to unauthorized actions, data exfiltration, or arbitrary command execution. While the skill's stated purpose is benign, this flaw represents a significant security risk.