project-timeline-board

一个真正零门槛的项目时间线管理页面——只需编辑一个 JS 配置文件（projectName / 关键节点 / 甘特图 / 待办清单），即可生成包含智能时间轴、甘特图、里程碑追踪和待办看板的完整页面。自动根据当前日期判断每个节点是'已完成'/'今日'/'即将到来'/'待启动'，无需手动标注；甘特图支持交互/视觉/前...

This skill appears to do exactly what it says: render a timeline/Gantt/todo UI from a JS config with no external credentials or install steps. Before using it: (1) inspect the two JS files (project-timeline-data.js and render-from-config.js) — they are small and readable; (2) avoid loading configs from untrusted sources because the renderer inserts config fields (extras.content, todo text, detail labels, etc.) into the page as HTML/innerHTML which can execute script (XSS) if untrusted; (3) note the page loads Google Fonts (external network request) — acceptable for most uses but relevant for air-gapped environments; (4) if you will serve this on a public site, sanitize any user-provided content before putting it into PROJECT_CONFIG. Otherwise the skill is internally consistent and low-risk.

Type: OpenClaw Skill Name: project-timeline-board Version: 2.2.0 The project-timeline-board skill is a front-end tool designed to generate project dashboards, Gantt charts, and todo lists from a JavaScript configuration file. The bundle includes an HTML template (project-timeline.html), a data configuration template (project-timeline-data.js), and a rendering script (render-from-config.js). The logic is entirely focused on client-side DOM manipulation to visualize project milestones and schedules. While the rendering script uses innerHTML to inject content from the configuration file (which is an intentional feature for allowing HTML in cards), there is no evidence of data exfiltration, unauthorized network activity, or malicious prompt injection. The behavior is consistent with the stated purpose of providing a data-driven project management interface.