← Back to Skills Marketplace
652
Downloads
0
Stars
2
Active Installs
1
Versions
Install in OpenClaw
/install local-task-runner
Description
Executes Node.js code snippets or scripts locally with isolation, cleanup, and timeout, serving as a lightweight alternative to spawning subagents.
README (SKILL.md)
Local Task Runner
This skill provides a mechanism to execute Node.js code snippets or full scripts locally on the host machine. It is the default execution method when subagent spawning is unavailable or inefficient.
Purpose
- Replace Subagents: Instead of spawning a full subagent for simple tasks, use this skill to run code directly.
- Safety: Isolates execution logic, handles cleanup, and enforces timeouts.
- Convenience: No manual file management required (
write+exec+rm).
Usage
When you need to perform a calculation, check system status, or run a utility script:
- Construct the Node.js code as a string.
- Call
run_task(or execute via CLI) with the code.
Command Line Interface
# Execute a task
node skills/local-task-runner/index.js run --code "console.log('Hello World')"
# Execute with timeout (ms)
node skills/local-task-runner/index.js run --code "while(true){}" --timeout 5000
Response Format
Success:
[TASK: \x3Cid>] Completed in 123ms
--- STDOUT ---
...
Error:
[TASK: \x3Cid>] Failed in 123ms
Error: ...
--- STDERR ---
...
Usage Guidance
This skill executes arbitrary Node.js code on your machine — that's exactly its purpose, but it means any code run can read files, network, and environment data. Before installing: ensure you have the Node runtime on the host, only allow trusted callers to invoke the skill (or disable autonomous invocation), and consider running it inside a dedicated low-privilege container or VM. Also ask the author to (1) declare 'node' as a required binary, (2) remove unused dependencies from package.json (uuid), and (3) document recommended sandboxing/permission guidance. If you cannot restrict who or what can call this skill, avoid installing it.
Capability Analysis
Type: OpenClaw Skill
Name: local-task-runner
Version: 1.0.0
The 'local-task-runner' skill is designed to execute arbitrary Node.js code provided as a string, writing it to a temporary file and executing it via `child_process.exec` in `index.js`. While this is its stated purpose (as per SKILL.md and README.md), it represents a critical Remote Code Execution (RCE) vulnerability. An attacker could leverage prompt injection against the OpenClaw agent to cause it to pass malicious Node.js code to this skill, leading to arbitrary code execution on the host machine. The skill itself does not contain malicious logic, but its core functionality is a high-risk capability that enables severe attacks.
Capability Assessment
Purpose & Capability
The skill's name, description, SKILL.md, and index.js are coherent: this is a local runner that writes a JS file and executes it with Node. However, the metadata lists no required binaries even though index.js invokes the 'node' binary via child_process.exec, so the declared requirements are incomplete. package.json lists a dependency on 'uuid' that the code does not use (index.js uses crypto), which is an unnecessary/untidy manifest mismatch.
Instruction Scope
SKILL.md and index.js instruct the agent to accept arbitrary JavaScript code, write it to disk, and execute it. That behavior is consistent with the stated purpose but inherently powerful: any executed snippet can read files, access environment variables, make network requests, or spawn processes. The skill itself does not sandbox beyond a timeout and maxBuffer, so the runtime instructions grant broad capability to code provided to the skill.
Install Mechanism
There is no install spec (instruction-only), which limits risk from installers. The package.json is present but there is no install step — the declared dependency ('uuid') is not used by index.js; this is likely an oversight rather than malicious but should be cleaned up to avoid confusion.
Credentials
The skill requests no environment variables or credentials and the provided code does not read env vars. However, because the skill executes arbitrary Node code, any code run could itself read environment variables, credentials available to the agent, or other local data — so the absence of declared env requirements does not prevent runtime snippets from accessing secrets present in the environment.
Persistence & Privilege
The skill does not request always:true and does not modify other skills, and it limits files to its own .tasks directory, which is reasonable. However, model invocation is enabled (agent can call the skill autonomously) and combined with the ability to run arbitrary host code this increases blast radius: an agent that autonomously invokes this skill could run unexpected tasks on the host. Consider restricting autonomous invocation or running the skill within a stricter sandbox/privilege boundary.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install local-task-runner - After installation, invoke the skill by name or use
/local-task-runner - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of local-task-runner.
- Enables execution of Node.js code snippets and scripts directly on the host machine.
- Provides a safer, more efficient alternative to subagent spawning for local tasks.
- Handles code isolation, resource cleanup, and configurable timeouts automatically.
- Includes a command-line interface for running tasks with optional timeout controls.
- Outputs clear, structured responses for both successful and failed executions.
Metadata
Frequently Asked Questions
What is Local Task Runner?
Executes Node.js code snippets or scripts locally with isolation, cleanup, and timeout, serving as a lightweight alternative to spawning subagents. It is an AI Agent Skill for Claude Code / OpenClaw, with 652 downloads so far.
How do I install Local Task Runner?
Run "/install local-task-runner" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Local Task Runner free?
Yes, Local Task Runner is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Local Task Runner support?
Local Task Runner is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Local Task Runner?
It is built and maintained by d-wwei (@d-wwei); the current version is v1.0.0.
More Skills