← 返回 Skills 市场
652
总下载
0
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install local-task-runner
功能描述
Executes Node.js code snippets or scripts locally with isolation, cleanup, and timeout, serving as a lightweight alternative to spawning subagents.
使用说明 (SKILL.md)
Local Task Runner
This skill provides a mechanism to execute Node.js code snippets or full scripts locally on the host machine. It is the default execution method when subagent spawning is unavailable or inefficient.
Purpose
- Replace Subagents: Instead of spawning a full subagent for simple tasks, use this skill to run code directly.
- Safety: Isolates execution logic, handles cleanup, and enforces timeouts.
- Convenience: No manual file management required (
write+exec+rm).
Usage
When you need to perform a calculation, check system status, or run a utility script:
- Construct the Node.js code as a string.
- Call
run_task(or execute via CLI) with the code.
Command Line Interface
# Execute a task
node skills/local-task-runner/index.js run --code "console.log('Hello World')"
# Execute with timeout (ms)
node skills/local-task-runner/index.js run --code "while(true){}" --timeout 5000
Response Format
Success:
[TASK: \x3Cid>] Completed in 123ms
--- STDOUT ---
...
Error:
[TASK: \x3Cid>] Failed in 123ms
Error: ...
--- STDERR ---
...
安全使用建议
This skill executes arbitrary Node.js code on your machine — that's exactly its purpose, but it means any code run can read files, network, and environment data. Before installing: ensure you have the Node runtime on the host, only allow trusted callers to invoke the skill (or disable autonomous invocation), and consider running it inside a dedicated low-privilege container or VM. Also ask the author to (1) declare 'node' as a required binary, (2) remove unused dependencies from package.json (uuid), and (3) document recommended sandboxing/permission guidance. If you cannot restrict who or what can call this skill, avoid installing it.
功能分析
Type: OpenClaw Skill
Name: local-task-runner
Version: 1.0.0
The 'local-task-runner' skill is designed to execute arbitrary Node.js code provided as a string, writing it to a temporary file and executing it via `child_process.exec` in `index.js`. While this is its stated purpose (as per SKILL.md and README.md), it represents a critical Remote Code Execution (RCE) vulnerability. An attacker could leverage prompt injection against the OpenClaw agent to cause it to pass malicious Node.js code to this skill, leading to arbitrary code execution on the host machine. The skill itself does not contain malicious logic, but its core functionality is a high-risk capability that enables severe attacks.
能力评估
Purpose & Capability
The skill's name, description, SKILL.md, and index.js are coherent: this is a local runner that writes a JS file and executes it with Node. However, the metadata lists no required binaries even though index.js invokes the 'node' binary via child_process.exec, so the declared requirements are incomplete. package.json lists a dependency on 'uuid' that the code does not use (index.js uses crypto), which is an unnecessary/untidy manifest mismatch.
Instruction Scope
SKILL.md and index.js instruct the agent to accept arbitrary JavaScript code, write it to disk, and execute it. That behavior is consistent with the stated purpose but inherently powerful: any executed snippet can read files, access environment variables, make network requests, or spawn processes. The skill itself does not sandbox beyond a timeout and maxBuffer, so the runtime instructions grant broad capability to code provided to the skill.
Install Mechanism
There is no install spec (instruction-only), which limits risk from installers. The package.json is present but there is no install step — the declared dependency ('uuid') is not used by index.js; this is likely an oversight rather than malicious but should be cleaned up to avoid confusion.
Credentials
The skill requests no environment variables or credentials and the provided code does not read env vars. However, because the skill executes arbitrary Node code, any code run could itself read environment variables, credentials available to the agent, or other local data — so the absence of declared env requirements does not prevent runtime snippets from accessing secrets present in the environment.
Persistence & Privilege
The skill does not request always:true and does not modify other skills, and it limits files to its own .tasks directory, which is reasonable. However, model invocation is enabled (agent can call the skill autonomously) and combined with the ability to run arbitrary host code this increases blast radius: an agent that autonomously invokes this skill could run unexpected tasks on the host. Consider restricting autonomous invocation or running the skill within a stricter sandbox/privilege boundary.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install local-task-runner - 安装完成后，直接呼叫该 Skill 的名称或使用
/local-task-runner触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of local-task-runner.
- Enables execution of Node.js code snippets and scripts directly on the host machine.
- Provides a safer, more efficient alternative to subagent spawning for local tasks.
- Handles code isolation, resource cleanup, and configurable timeouts automatically.
- Includes a command-line interface for running tasks with optional timeout controls.
- Outputs clear, structured responses for both successful and failed executions.
元数据
常见问题
Local Task Runner 是什么？
Executes Node.js code snippets or scripts locally with isolation, cleanup, and timeout, serving as a lightweight alternative to spawning subagents. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 652 次。
如何安装 Local Task Runner？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install local-task-runner」即可一键安装，无需额外配置。
Local Task Runner 是免费的吗？
是的，Local Task Runner 完全免费（开源免费），可自由下载、安装和使用。
Local Task Runner 支持哪些平台？
Local Task Runner 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Local Task Runner？
由 d-wwei（@d-wwei）开发并维护，当前版本 v1.0.0。
推荐 Skills