← 返回 Skills 市场

Agent Task Manager

Name: Agent Task Manager
Author: abeltennyson

作者 AbelTennyson · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install abel-agent-task-manager

功能描述

Manages and orchestrates multi-step, stateful agent workflows; handles task dependencies, persistent state, error recovery, and external rate-limiting. Use f...

使用说明 (SKILL.md)

Agent Task Manager

Overview

This skill provides the structure and primitives for building resilient, complex, and professional multi-agent systems powered by the SkillBoss API Hub. It transforms simple scripts into production-ready workflows, with AI capabilities (LLM reasoning, notification delivery) routed through a single unified endpoint.

Core Capabilities

1. Orchestration and Task State

Capability: Defines tasks with clear inputs, outputs, and dependencies (DAG-like structure).
Execution: Uses molt_task.py to manage state in task_state.json.
Value: Prevents redundant work, allows agents to resume mid-workflow after a session reset.

2. External Rate-Limit Management

Capability: Manages the cooldown and retry logic for externally rate-limited actions (e.g., API posts, web scrapes).
Execution: Uses the scripts/cooldown.sh wrapper to store last-executed timestamps and automatically wait/retry.
Value: Ensures continuous operation without violating API rate limits.

3. Modular Role-Based Agents

Capability: Provides a template structure for specialized roles (e.g., ContractAuditor, FinancialAnalyst).
Execution: Modules are designed to be run independently or sequenced by the Orchestrator. AI reasoning steps call the SkillBoss API Hub (/v1/pilot) for LLM inference and notification delivery.
Value: Enables the creation of focused, expert agents for complex tasks like the MoltFinance-Auditor.

Example Workflow: MoltFinance-Auditor

Task: FinancialAudit
Dependencies:
- Role 1: ContractAuditor (Input: Contract Address, Output: Contract Safety Score)
- Role 2: FinancialAnalyst (Input: Contract Address + Safety Score, Output: Trust Score via SkillBoss API Hub LLM)
External Action: NotificationAgent (Dependent on final Trust Score; delivers alert via SkillBoss API Hub email/SMS; subject to Rate Limit).

API Integration

All AI inference and notification delivery is handled through SkillBoss API Hub:

Endpoint: https://api.heybossai.com/v1/pilot
Auth: Authorization: Bearer $SKILLBOSS_API_KEY
LLM response path: data.result.choices[0].message.content

Resources

scripts/

molt_task.py: Python class for task state management.
orchestrator.py: Workflow execution engine; calls SkillBoss API Hub for AI role execution.
task_parser.py: Converts natural language requests to task structures; uses SkillBoss API Hub LLM as fallback parser.
cooldown.sh: Shell wrapper for managing rate-limited executions.

references/

task_schema.md: JSON schema for defining complex task dependencies.

安全使用建议

This skill appears to implement an agent orchestrator that uses the SkillBoss API — which is consistent with its description — but take these precautions before installing or using it: - Metadata mismatch: The registry shows no required env vars but both SKILL.md and the code require SKILLBOSS_API_KEY. Expect to provide that API key; ask the publisher to correct the registry metadata. - Limit the credential: If you try the skill, use a dedicated SkillBoss API key with minimal privileges and scope (not your primary org key). Rotate or revoke the key after testing. - Review or remove cooldown.sh if you will run wrapped commands: cooldown.sh uses eval to run arbitrary commands; do not pass untrusted text into it. If you won't use it, remove or harden the script to avoid eval. - Sandbox first: Run the skill in an isolated environment to observe behavior (network calls, files written: task_state.json and agent_task_manager_data/). Check what is sent to api.heybossai.com and whether responses are parsed safely. - Validate parser outputs: The task parser trusts the LLM response and json.loads it; validate that returned JSON matches the schema before executing tasks. - Verify source: The skill lists no homepage and the owner ID is opaque. If you need to run this in production, ask the publisher for provenance, a code repository, or a signed release so you can audit the source. If you cannot confirm the source or do not want to provide an API key, do not install or run this skill. If you proceed, use a least-privilege key and test in a sandbox first.

功能分析

Type: OpenClaw Skill Name: abel-agent-task-manager Version: 1.0.0 The skill bundle contains a critical shell injection vulnerability in 'scripts/cooldown.sh' due to the use of 'eval' on unsanitized command arguments. It also relies heavily on an external third-party API ('api.heybossai.com') for core logic, including task parsing and LLM inference, which involves transmitting the 'SKILLBOSS_API_KEY' and task data to an external endpoint. While these features align with the stated purpose of managing agent workflows and crypto-monitoring, the combination of insecure execution patterns and external dependencies poses a significant security risk.

能力标签

requires-sensitive-credentials

能力评估

ℹ Purpose & Capability

The skill's name, description, and code align: it orchestrates multi-step workflows, persists local state, manages cooldowns, and routes LLM/notification calls to a single API (api.heybossai.com). Requiring an API key for SkillBoss is coherent with its purpose. However, the registry metadata lists no required environment variables while SKILL.md and the Python code clearly expect SKILLBOSS_API_KEY — a metadata inconsistency.

ℹ Instruction Scope

Runtime instructions and code confine activity to workflow parsing, local JSON state (task_state.json), a timestamp directory (agent_task_manager_data), and HTTP calls to the SkillBoss API Hub. That scope matches the claimed functionality. Two points to note: (1) cooldown.sh uses eval "$COMMAND" which lets wrapped commands execute arbitrary shell code if the wrapper is used with untrusted inputs, and (2) fallback parsing sends user text to the external LLM and then attempts to parse returned JSON without robust validation. These are design risks but are explainable by the skill's purpose.

✓ Install Mechanism

There is no install spec (instruction-only with included scripts), so nothing is downloaded automatically. That minimizes install-time risk — code files are bundled with the skill and run locally.

⚠ Credentials

Functionality requires a single external credential (SKILLBOSS_API_KEY) which is proportionate to the skill's use of the SkillBoss API. The problem is that the registry metadata lists no required env vars while SKILL.md and multiple code files directly read SKILLBOSS_API_KEY (os.environ["SKILLBOSS_API_KEY"]). This mismatch is an incoherence that could lead to runtime errors or accidental disclosure because the registry did not declare the secret requirement.

✓ Persistence & Privilege

The skill persists state locally (task_state.json and agent_task_manager_data/<key>_last_run.txt) which is expected for an orchestrator. always:false (not force-included) and no claims of modifying other skills or system-wide settings. Note: because it can be invoked autonomously and has outbound network access (SkillBoss API), an exposed API key would permit external communication — consider the usual caution about keys for autonomously-invoked skills.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install abel-agent-task-manager
安装完成后，直接呼叫该 Skill 的名称或使用 /abel-agent-task-manager 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release

元数据

Slug abel-agent-task-manager

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题