To-Do

Give your AI the power to act in the future. Schedule delayed prompts and one-off reminders that automatically wake the agent up at an exact moment to execut...

This skill generally does what it says — it schedules the OpenClaw agent to run later — but it currently trusts callers to avoid dangerous inputs instead of enforcing safety. Before installing: 1) Confirm OPENCLAW_BIN points to a trusted, least-privileged OpenClaw binary. 2) Review or modify to-do.js to avoid shell-based exec interpolation (use spawn/execFile with argument arrays or strictly validate/sanitize userId, channel, and task content). 3) Test scheduling in a non-production environment to confirm no command-injection paths exist (try attacker-style inputs). 4) Prefer restricting scheduled messages to non-sensitive content and avoid embedding secrets or write-access file paths in scheduled instructions. If you want higher assurance, ask the author to add input validation and change exec usage to a safer API; having that change would increase confidence from medium to high.

Type: OpenClaw Skill Name: to-do Version: 1.0.3 The `to-do.js` skill contains multiple command injection vulnerabilities across both Windows and Linux/macOS platforms. User-controlled input, specifically the `<instruction>` argument for scheduling and the `<ID>` argument for deletion (on Linux/macOS), is not sufficiently sanitized before being passed to `child_process.exec`. While `SKILL.md` attempts to instruct the AI agent to avoid shell meta-characters, this relies on the agent's adherence and does not fix the underlying code vulnerabilities, making the skill susceptible to prompt injection attacks leading to arbitrary command execution. For example, on Windows, the `flatInstruction` passed to `schtasks /tr` is vulnerable to quote breaking, and on Linux/macOS, `agentCommand` is unsafely embedded within double quotes in an `echo` command, allowing shell metacharacters like `$(command)` to execute. The `atrm ${id}` command on Linux/macOS also lacks quoting, making it vulnerable to injection if the ID contains shell metacharacters.