Taskboard Cli

Lightweight task management CLI for multi-agent workflows. SQLite backend, no external dependencies or credentials. Status-change hooks emit agent instructio...

What to consider before installing: - The shipped Python CLI (scripts/taskboard.py) appears to be a local SQLite tool and does not itself make network calls — that part is coherent and low-risk. - The reference docs, however, describe optional GitHub and webhook integrations that require you to supply tokens (e.g., GITHUB_TOKEN, Discord webhooks) and run wrapper scripts that perform network requests. These integrations are not declared in the registry metadata — treat them as opt-in and only provide secrets to trusted processes. - Documentation inconsistencies: one reference uses a JSON file-based model (taskboard.json) while the actual code uses SQLite; this suggests stale or copy-pasted docs. Verify which backend you will use before relying on automation. - The CLI lets you override the DB path (--db). Don't point it at system or sensitive files; running the tool with a path you don't control could read/overwrite data with the running user's permissions. - Hooks are printed to stdout and may contain instructions that an agent could act on (e.g., send messages, spawn sessions). Ensure your agents do not auto-execute hook output unless you trust the source and have validation/sanitization in place. - Recommended actions: inspect the full scripts/taskboard.py (including the truncated portion), run the tool in an isolated/sandbox environment, and if you enable GitHub/webhook integrations, use least-privilege tokens and separate service accounts. If anything in the references will be run automatically by an agent, require explicit user approval before providing credentials or enabling networked wrappers.

Type: OpenClaw Skill Name: taskboard-cli Version: 3.0.1 The taskboard-cli skill is a legitimate SQLite-based task management tool for multi-agent workflows. The Python implementation (scripts/taskboard.py) follows security best practices, such as using parameterized queries to prevent SQL injection and restricting file operations to the local database. The 'Hooks' feature, which emits instructions for agents to follow upon task status changes, is a documented orchestration mechanism and lacks any evidence of malicious intent or hidden prompt-injection attacks. The documentation (references/github-backend.md and others) provides standard integration guides without requesting unauthorized access or exfiltrating data.