TODO Web App

Deploy a local TODO web app that reads and writes a Markdown TODO.md file. Serves a beautiful dark-themed, glassmorphism UI on the LAN (no HTTPS needed). Fea...

This skill appears to do exactly what it says: run a local Node.js server that reads/writes TODO.md and archives completed items. Before installing: 1) Inspect server.js yourself (it modifies TODO.md and appends to TODO-done.md). 2) Place the script where you intend and ensure TODO.md is the correct file (it uses the parent directory of server.js). 3) Be aware it serves plain HTTP on your LAN without authentication—anyone on your local network who can reach your host:3456 can view and toggle tasks. Don't install on a machine with sensitive TODO.md contents or on an untrusted network. 4) When following the launchd steps, open the plist file and verify the node and server.js paths and the run arguments before running launchctl load; if you prefer not to auto-start, skip the launchd step. 5) Consider firewall rules or binding to localhost if you want to restrict access. If you want additional assurance, run the server inside a restricted account/container or change file permissions so only an intended user can edit TODO.md.

Type: OpenClaw Skill Name: todo-webapp Version: 1.0.1 The skill deploys a Node.js web server (scripts/server.js) that manages local Markdown files and establishes persistence via a macOS launchd agent. While the functionality matches the description, the server contains a Stored XSS vulnerability because it renders TODO item text directly into the HTML without sanitization. Furthermore, the server listens on all network interfaces (0.0.0.0) without authentication or CSRF protection, potentially allowing any device on the local network to read or modify the user's TODO files.