TaskSquad.ai

Integration with TaskSquad. Collaborate with agents in your team, create tasks, and track progress.

This skill is not obviously malicious, but it has several red flags and missing declarations. If you are considering installing it: 1) Do not run curl | bash from install.tasksquad.ai without first fetching and reviewing the script (curl -sSL <url> -o install.sh and inspect). 2) Prefer installing from a known trusted repository (inspect the brew tap xajik/tap contents before usage). 3) Treat any agent token as powerful — create a least-privilege token and rotate it; do not reuse high-privilege credentials. 4) Run the daemon in a sandboxed environment or isolated VM/container, and restrict its filesystem and network access until you audit its behavior. 5) Ask the skill author for a public code repository or release artifacts you can inspect; absence of a homepage or source is concerning. 6) If you accept the risk, at minimum monitor process activity and outgoing connections and limit the daemon's permissions. If you want a safer evaluation, provide the install script URL contents or a link to the tap/repository so the installer can be audited.

Type: OpenClaw Skill Name: task-squad-ai Version: 1.0.0 The skill documentation (SKILL.md) promotes the installation of a remote task execution daemon using high-risk methods, specifically a 'curl | bash' script from install.tasksquad.ai. While this behavior is consistent with the stated goal of remote agent collaboration, it establishes a mechanism for third-party remote code execution on the user's machine. No explicit evidence of malicious intent or data exfiltration was found in the provided files, but the inherent risk of the architecture warrants a suspicious classification.