Description

Fetch, display, create, and delete Google Tasks using the Google Tasks API. Use when the user asks to check, view, list, get, add, create, remove, or delete their Google Tasks, to-do lists, or task items. Handles OAuth authentication automatically using bash script with curl and jq.

README (SKILL.md)

Google Tasks Skill

Name: Google Tasks
Author: addozhang

Manage Google Tasks from all task lists using lightweight bash scripts.

Quick Start

View tasks

bash scripts/get_tasks.sh

Create a task

# Using default list (configured in google-tasks-config.sh)
bash scripts/create_task.sh "Task title" ["due-date"] ["notes"]

# Specifying list name
bash scripts/create_task.sh "List Name" "Task title" ["due-date"] ["notes"]

Examples:

# Simple task (uses default list)
bash scripts/create_task.sh "Buy groceries"

# Task with due date (uses default list)
bash scripts/create_task.sh "Finish report" "2026-02-10"

# Task with specific list
bash scripts/create_task.sh "Work" "Finish report" "2026-02-10"

# Task with list, due date, and notes
bash scripts/create_task.sh "Personal" "Call mom" "2026-02-05" "Ask about her health"

Default list configuration: Edit google-tasks-config.sh to set your default list:

DEFAULT_LIST="Private"  # Change to your preferred default

Delete a task

bash scripts/delete_task.sh "List Name" \x3Ctask-number-or-title>

Examples:

# Delete by task number (position in list)
bash scripts/delete_task.sh "Work" 2

# Delete by task title
bash scripts/delete_task.sh "Inbox" "Buy groceries"

Requirements

jq - JSON processor (usually pre-installed)
curl - HTTP client (usually pre-installed)
Valid token.json with OAuth access token
Scopes required: https://www.googleapis.com/auth/tasks (read + write)

First-Time Setup

If token.json doesn't exist:

User needs OAuth credentials (credentials.json) - See setup.md
Run the Node.js authentication flow first to generate token.json
Then the bash script can be used for all subsequent calls

Output Format

📋 Your Google Tasks:

📌 List Name
──────────────────────────────────────────────────
  1. ⬜ Task title (due: YYYY-MM-DD)
     Note: Task notes if present
  2. ⬜ Another task

📌 Another List
──────────────────────────────────────────────────
  (no tasks)

File Locations

token.json - Access/refresh tokens (workspace root)
google-tasks-config.sh - Configuration file (default list setting)
scripts/get_tasks.sh - Bash script to view tasks
scripts/create_task.sh - Bash script to create tasks
scripts/delete_task.sh - Bash script to delete tasks
references/setup.md - Detailed setup guide

Implementation

The bash script uses:

Google Tasks REST API directly
curl for HTTP requests
jq for JSON parsing
Bearer token authentication from token.json

No Python dependencies required.

Troubleshooting

Token expired:

Error: Invalid credentials

Delete token.json and re-authenticate.

Missing jq:

bash: jq: command not found

Install jq: apt-get install jq or brew install jq

For more details, see setup.md.

Usage Guidance

This skill appears to do what it says, but before installing or running it: 1) Review and never commit credentials.json or token.json — these contain your client secret and tokens. 2) Run npm install (or otherwise install Node/Python) before using the Node/Python auth helpers; inspect package.json dependencies. 3) The auth flow starts a local HTTP server (port 3000) and opens your browser to complete OAuth — ensure that behavior is acceptable. 4) If you prefer, run the scripts manually the first time to observe what they do; verify all network calls are to Google endpoints (accounts.google.com, oauth2.googleapis.com, tasks.googleapis.com). 5) If you will use this in a shared environment, consider creating a dedicated OAuth client with minimal scopes and adding only required test users in Google Cloud Console.

Capability Analysis

Type: OpenClaw Skill Name: google-tasks Version: 1.0.0 The OpenClaw AgentSkills skill bundle for Google Tasks is classified as benign. All scripts (bash, Node.js, Python) transparently interact with legitimate Google Tasks and OAuth API endpoints (tasks.googleapis.com, oauth2.googleapis.com) to manage tasks and handle authentication. Sensitive files like `token.json` and `credentials.json` are handled locally and explicitly git-ignored, as confirmed by `CLAWHUB_CHECKLIST.md`. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution beyond the stated purpose, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md` or `README.md`.

Capability Assessment

ℹ Purpose & Capability

The skill name/description match the implementation: scripts call the Google Tasks REST API and perform create/list/delete operations. Minor incoherence: the registry metadata declares no required binaries/env, but SKILL.md and the scripts require curl, jq and (for the auth helpers) Node.js or Python and a local credentials.json/token.json. package.json lists google-auth-library and googleapis, yet there is no automated install spec — this is plausible but should be documented to users.

✓ Instruction Scope

SKILL.md instructs the agent to run local bash/node/python scripts, open a browser for OAuth, and store token.json in the workspace root. The runtime behavior is limited to reading/writing credentials.json and token.json and calling Google endpoints (accounts.google.com, oauth2.googleapis.com, tasks.googleapis.com). There are no hidden external endpoints, obfuscated code, or instructions to read unrelated system files.

ℹ Install Mechanism

There is no install spec in the registry (instruction-only), which is low risk. The repo contains package.json dependencies for Node; the README suggests running npm install, but there's no automated installer. All code is local and uses standard, well-known hosts (Google). No downloads from untrusted URLs or extract semantics were found.

ℹ Credentials

The skill requests no environment variables, and it uses local credential files (credentials.json and token.json) rather than injected secrets — this is proportionate to a Google OAuth flow. Users should note that token.json contains access/refresh tokens and credentials.json contains client_id/secret; both are sensitive and must be protected (the project includes a .gitignore entry for them).

✓ Persistence & Privilege

always is false and the skill does not request system-wide privileges. It writes only its own token.json in the workspace root and starts a temporary local HTTP server for the OAuth redirect (port 3000). It does not modify other skills or global agent settings.

Version History

v1.0.0

Initial release: View, create, and delete Google Tasks using lightweight bash scripts with OAuth authentication. No Python dependencies required.

Metadata

Slug google-tasks

Version 1.0.0

License —

All-time Installs 8

Active Installs 7

Total Versions 1

Frequently Asked Questions

What is Google Tasks?

Fetch, display, create, and delete Google Tasks using the Google Tasks API. Use when the user asks to check, view, list, get, add, create, remove, or delete their Google Tasks, to-do lists, or task items. Handles OAuth authentication automatically using bash script with curl and jq. It is an AI Agent Skill for Claude Code / OpenClaw, with 2134 downloads so far.

How do I install Google Tasks?

Run "/install google-tasks" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Google Tasks free?

Yes, Google Tasks is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Google Tasks support?

Google Tasks is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Google Tasks?

It is built and maintained by Addo.Zhang (@addozhang); the current version is v1.0.0.

More Skills

Google Tasks