← Back to Skills Marketplace
Goal Setter
by
bytesagain1
· GitHub ↗
· v1.0.0
· MIT-0
281
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install goal-setter
Description
Goal Setter — Goal Setter — achieve your goals step by step. Personal daily-use tool for tracking and organizing your life. Use when you need Goal Setter cap...
README (SKILL.md)
Goal Setter
Goal Setter — achieve your goals step by step
Why This Skill?
- Designed for everyday personal use
- No external dependencies or accounts needed
- Data stored locally — your privacy, your data
- Simple commands, powerful results
Commands
set— \x3Cgoal> [deadline] Set a new goalmilestone— \x3Cgoal> \x3Cstep> Add milestone to goalprogress— \x3Cgoal> \x3Cpct> Update progress (0-100%)check— \x3Cgoal> \x3Cmilestone> Check off milestonelist— List all goalsactive— Show active goalsreview— Weekly goal reviewmotivate— Motivational quotearchive— \x3Cgoal> Archive completed goalstats— Goal statisticsinfo— Version info
Quick Start
goal_setter.sh help
Note: This is an original, independent implementation by BytesAgain. Not affiliated with or derived from any third-party project.
Powered by BytesAgain | bytesagain.com | [email protected]
Usage Guidance
This skill appears to do what it says — local goal tracking — but review or patch the bundled script before trusting it. The script embeds unescaped user input into inline Python, which can cause crashes or allow code execution if goal text contains quotes, newlines, or special characters. If you want to use it: (1) run it in a safe, single-user environment; (2) back up ~/.goals before use; (3) prefer fixing the script by passing user data safely to Python (e.g., use python to read argv or stdin, or use json.dumps to serialize variables) rather than interpolating shell variables into code; (4) document GOAL_DIR usage since SKILL.md omits it. If you are not comfortable editing shell/Python, consider not installing or requesting a corrected version from the author.
Capability Analysis
Type: OpenClaw Skill
Name: goal-setter
Version: 1.0.0
The script `scripts/goal_setter.sh` contains multiple critical code injection vulnerabilities where unsanitized shell variables (such as `$goal`, `$step`, and `$pct`) are embedded directly into Python commands executed via `python3 -c` and heredocs. This allows for arbitrary Python code execution if a user or a malicious prompt provides a crafted input string. While the tool's logic appears to align with its stated purpose of goal tracking and no evidence of intentional malice or data exfiltration was found, the high-risk nature of these vulnerabilities warrants a suspicious classification.
Capability Assessment
Purpose & Capability
Name/description match the included functionality: a local goal tracker that stores data under $HOME/.goals. The script requires only bash and python3 (SKILL.md lists python3 runtime), and there are no unexpected network calls or third-party credentials. Minor mismatch: SKILL.md states 'no environment variables required' but the script honors an optional GOAL_DIR env var to change storage location.
Instruction Scope
The runtime instructions and the shipped script remain within the stated purpose (creating/updating a local JSON goals DB). However the script builds Python code by directly interpolating shell variables (e.g., $goal, $deadline, $pct) into python -c / heredoc blocks without escaping. This is fragile and dangerous: specially crafted goal text (quotes, newlines, or Python tokens) can break the Python snippets or be used to inject/execute arbitrary Python. Example problems: unquoted $deadline inserted into a Python 'if' expression can cause syntax errors or unexpected evaluation; single quotes inside a goal can break string literals. This is a code-injection / code-execution risk for the local user context and could also lead to data corruption. The SKILL.md suggests local-only storage and privacy, but the script's unescaped interpolation undermines safe handling of user-provided strings.
Install Mechanism
No install spec is provided (instruction-only with bundled script), so nothing is downloaded or executed at install time. This keeps install risk low. The only runtime dependency is python3 which the SKILL.md already declares.
Credentials
The skill declares no required environment variables, which matches its simple local design. The script, however, honors GOAL_DIR if present (defaults to $HOME/.goals). This is a reasonable, limited opt-in override but should be documented in SKILL.md. No credentials or unrelated env vars are requested.
Persistence & Privilege
The skill does not request system-wide privileges and is not always-enabled. It writes data only to a per-user directory (default $HOME/.goals or GOAL_DIR). It does not modify other skills or global agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install goal-setter - After installation, invoke the skill by name or use
/goal-setter - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is Goal Setter?
Goal Setter — Goal Setter — achieve your goals step by step. Personal daily-use tool for tracking and organizing your life. Use when you need Goal Setter cap... It is an AI Agent Skill for Claude Code / OpenClaw, with 281 downloads so far.
How do I install Goal Setter?
Run "/install goal-setter" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Goal Setter free?
Yes, Goal Setter is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Goal Setter support?
Goal Setter is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Goal Setter?
It is built and maintained by bytesagain1 (@bytesagain1); the current version is v1.0.0.
More Skills