Task Tracker

Personal task management with daily standups and weekly reviews. Use when: (1) User says 'daily standup' or asks what's on their plate, (2) User says 'weekly review' or asks about last week's progress, (3) User wants to add/update/complete tasks, (4) User asks about blockers or deadlines, (5) User shares meeting notes and wants tasks extracted, (6) User asks 'what's due this week' or similar.

This skill largely looks like a local task manager, but a few mismatches deserve attention before installing: - Review the actual script contents (scripts/*.py and scripts/telegram-commands.sh) before running the install or init script. The SKILL.md will run python3 scripts/init.py — inspect that script to see what files it creates or modifies. - Check for network calls in the scripts (HTTP requests, curl, or use of telegram APIs). If the skill is going to post to Telegram, it should declare the TELEGRAM_TOKEN or similar credential; absence of such an env var in the registry is suspicious. Don't provide secrets until you confirm where/how they're used. - Be cautious with the extract_tasks flow: it parses free text and emits shell commands like tasks.py add ... — ensure those outputs are never executed automatically on untrusted input to avoid injection. Prefer manual review of extracted commands or add sanitization. - Because the model can invoke the skill by default, consider setting disableModelInvocation or requiring explicit user triggers if you want to avoid autonomous modifications to your TASKS.md. If you want higher confidence, provide the contents of the scripts (init.py, tasks.py, extract_tasks.py, telegram-commands.sh) so they can be inspected for network destinations, shell execution, credential use, or writes to paths outside ~/clawd/memory/work.

Type: OpenClaw Skill Name: task-tracker Version: 1.0.0 The OpenClaw AgentSkills skill bundle is classified as benign. All scripts and documentation consistently describe a local task management system operating within the designated `~/clawd/memory/work/` directory. File operations (read/write to `TASKS.md` and `ARCHIVE-YYYY-QN.md`) are strictly confined to this purpose. There is no evidence of data exfiltration, unauthorized network activity, malicious execution, persistence mechanisms established by the skill itself (cron jobs are instructions for the Clawdbot agent), or obfuscation. The LLM prompt generation in `scripts/extract_tasks.py` is a controlled feature for task extraction, not a prompt injection attack against the agent.