Todolist Md Clawdbot

Read, summarize, propose edits, and write back changes for Markdown todo files using line-stable bot markers without altering task identity.

This skill implements a Drive-backed Markdown todo editor and will need Google Drive credentials (access token or CLIENT_ID/CLIENT_SECRET + auth flow) and, optionally, gog CLI credentials. Before installing: (1) understand you'll need to provide Drive/gog credentials and may need to run sudo for the gog CLI; (2) review and accept that the skill will store a refresh token under /root/clawd/.secrets (persistent secret on disk); (3) consider running it in an isolated account/container with least privilege, or modify the scripts to use a dedicated service account and a narrower OAuth scope; (4) verify the metadata mismatch (no declared env/config) with the publisher and ensure you supply only minimal credentials needed; and (5) inspect the scripts yourself (or have someone you trust do so) before granting access to sensitive accounts.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is classified as suspicious due to several risky capabilities and potential vulnerabilities, though without clear evidence of intentional malicious behavior. The `SKILL.md` defines `<!-- bot: ... -->` markers as instructions for the AI agent, creating a prompt injection surface. The `todolist_review_drive.py` script inserts `root_folder_id` and `model` values directly into `<!-- bot: last_review -->` markers; if these values are user-controlled and untrusted, they could be exploited for prompt injection. Additionally, both `todolist_drive_folder_agent.mjs` and `todolist_review_drive.py` execute external `gog` commands using `sudo -u ubuntu`, indicating the agent has `sudo` capabilities and executes commands as a different user. While argument passing is robust against shell injection, the use of `sudo` and external binaries represents a powerful primitive that, if misconfigured or if the `gog` binary itself were compromised, could lead to unauthorized execution. There is no evidence of data exfiltration to unauthorized endpoints, backdoors, or obfuscation.