Openclaw Skill Parallel Tasks

Execute multiple tasks in parallel with timeout protection, error isolation, and real-time progress feedback. Use when user says "run these in parallel", "pa...

This skill is plausibly what it claims (a parallel task runner) but it has a few red flags you should verify before installing: 1) The code calls an external 'hermes' CLI to spawn sessions but the skill metadata does not list any required binary—ensure your environment provides a trusted hermes binary or that the skill is updated to declare it. 2) The executor forwards the entire process.env to spawned processes; if your agent runtime holds secrets (API keys, tokens), those could be exposed to the hermes process—ask the author to avoid forwarding unrelated env vars or to document exactly what hermes needs. 3) Task text read from files or stdin is passed verbatim to an external CLI; review/validate task inputs to avoid accidental leakage of sensitive content or injection into the external subsystem. If you trust the hermes CLI and the skill author, require an update to declare required binaries and to minimize env forwarding; otherwise treat this as untrusted code and audit carefully before use.

Type: OpenClaw Skill Name: openclaw-skill-parallel-tasks Version: 1.0.0 The skill provides a utility for parallel task execution within the OpenClaw environment by spawning sub-sessions via the 'hermes cli'. The implementation in 'scripts/executor.ts' manages concurrency, timeouts, and error isolation as described in 'SKILL.md' and 'README.md'. While the script contains a minor vulnerability in how it handles command-line arguments (splitting by spaces after joining strings), there is no evidence of malicious intent, data exfiltration, or unauthorized persistence. The code is well-documented and its high-risk capabilities (spawning processes) are essential to its stated purpose.