← Back to Skills Marketplace
101
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install tasktodolist
Description
Manage multiple independent to-do lists with commands to add, list, complete, remove, clear tasks, and manage task lists by name.
Usage Guidance
This appears to be a straightforward local todo CLI. Before installing: (1) verify the package source you are installing from (the registry metadata owner is shown but there's no homepage); (2) inspect package.json and src/index.js (the package runs a harmless postinstall chmod and installs a CLI binary when installed globally); (3) be aware that todos are stored as plain JSON under ~/.tasktodolist — do not store sensitive secrets there; (4) if uncomfortable with global install, run npm install locally and review files before running; (5) the version number discrepancy (registry 1.0.1 vs package.json 1.0.0) is likely minor but worth confirming with the publisher.
Capability Analysis
Type: OpenClaw Skill
Name: tasktodolist
Version: 1.0.1
The skill implements a functional todo list manager but contains a path traversal vulnerability in `src/index.js`. The `--task` argument is used to construct file paths via `path.join` without sanitization, allowing potential access to files outside the intended `~/.tasktodolist` directory if directory traversal sequences (e.g., `../`) are provided. While the logic appears aligned with its stated purpose and lacks clear malicious intent, this vulnerability represents a security flaw.
Capability Assessment
Purpose & Capability
The name and description match the code and SKILL.md: the tool manages multiple named todo lists and stores them as JSON files under ~/.tasktodolist. The declared dependency (commander) is appropriate. Minor metadata mismatch: registry version is 1.0.1 while package.json lists 1.0.0 — likely benign but worth noting.
Instruction Scope
SKILL.md instructions precisely describe the CLI behavior and the storage path. The included src/index.js implements only local file I/O (create/read/write/unlink) under BASE_DIR and standard CLI commands; it does not read other system files, environment variables, or send data externally.
Install Mechanism
No remote download/install URLs are used. Installation is standard npm (local or global). package.json includes a postinstall step to chmod the script (chmod +x src/index.js), which is plausible/normal for a CLI package but should be inspected before running.
Credentials
The skill requests no environment variables, no credentials, and no config paths beyond creating files under the user's home directory. There are no tokens or secrets referenced.
Persistence & Privilege
always:false (default) and the skill does not modify other skills or system-wide agent settings. Global npm install will add a binary to PATH (expected for CLIs) and the tool creates files in the user's home directory — both are proportionate to its purpose.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tasktodolist - After installation, invoke the skill by name or use
/tasktodolist - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Updated data storage location: tasks are now saved in the user's home directory under `~/.tasktodolist/` instead of the `data/` folder.
- No code changes; documentation updated to reflect the new storage path.
v1.0.0
Initial release – simple, multi-list to-do manager (replaces macOS Reminders version):
- New CLI tool to manage multiple named to-do lists (`--task <name>`)
- Add, list, mark as done, remove, and clear to-do items by command
- Manage multiple lists: list all tasks, delete task lists
- Stores lists in separate JSON files under `data/`
- Usage and install documented in README
- No macOS/Reminders dependency; works cross-platform
Metadata
Frequently Asked Questions
What is tasktodolist?
Manage multiple independent to-do lists with commands to add, list, complete, remove, clear tasks, and manage task lists by name. It is an AI Agent Skill for Claude Code / OpenClaw, with 101 downloads so far.
How do I install tasktodolist?
Run "/install tasktodolist" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is tasktodolist free?
Yes, tasktodolist is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does tasktodolist support?
tasktodolist is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created tasktodolist?
It is built and maintained by guiguihao (@guiguihao); the current version is v1.0.1.
More Skills