Task System

Manage tasks with automatic creation, SQLite tracking, heartbeat updates, notifications, stuck task detection, and recovery in a complete lifecycle system.

This skill appears to implement a simple local task tracker and is internally consistent, but take these precautions before installing or enabling it: - Inspect install.sh and DO NOT run it blindly. It will append or write to ~/.bashrc or ~/.bashrc.d and create a symlink in ~/.local/bin. Back up your shell config first. - The scripts build SQL by concatenating user-supplied values. An attacker (or a malformed ID/notes string) could inject extra SQL. Before using in production, modify the scripts to validate inputs (e.g., ensure TASK_ID matches ^[0-9]+$) and sanitize fields consistently. - Consider running the scripts in a limited environment or container and keep the database under a directory you control; back up the DB before first use. - If you allow an autonomous agent to invoke this skill, be cautious: the agent could call create/heartbeat/complete with attacker-controlled strings. If you cannot audit and harden the scripts, do not grant the agent autonomous use of the skill. If you want, I can produce hardened patch suggestions (e.g., input validation snippets and safer SQL invocation patterns) you can apply to the scripts before installing.

Type: OpenClaw Skill Name: task-system Version: 1.0.1 The skill is classified as suspicious due to multiple SQL injection vulnerabilities found across `scripts/complete-task.sh`, `scripts/create-task.sh`, `scripts/heartbeat.sh`, and `scripts/task-system.sh`. Specifically, the `$TASK_ID` variable is directly concatenated into SQL queries without sanitization, allowing for arbitrary SQL command injection (e.g., `1; DROP TABLE tasks;`). While some inputs like `$REQUEST` and `$NOTES` attempt basic single-quote escaping with `sed`, this method is not robust and the direct insertion of `$TASK_ID` represents a critical flaw, enabling potential database manipulation or data loss. There is no evidence of intentional malicious behavior like data exfiltration or backdoors, but these vulnerabilities pose a significant security risk.