taskleef

Use when managing todos, tasks, projects, or kanban boards via Taskleef.com. Supports adding, listing, completing, deleting todos, organizing with projects, and managing kanban boards. Use when the user wants to track tasks, manage their todo list, organize work by projects, or use kanban workflows.

This skill appears coherent for managing Taskleef todos, but take these precautions before installing: - Verify that https://taskleef.com is the legitimate service you expect. - Inspect the 'todo' file the installer downloads from raw.githubusercontent.com before running chmod +x; raw GitHub content can be arbitrary code. Prefer installing from an official release repository or building from source when possible. - Keep TASKLEEF_API_KEY secret: store it in the agent config or an auth file with restrictive permissions (e.g., chmod 600), and do not commit it into dotfiles or public repos. - Expect the todo CLI to make network requests to Taskleef APIs (normal for this skill); if you need tighter control, run the CLI in a constrained environment or review network activity. If you want extra assurance, ask the skill author for an official release URL or published package and for the source repository for the todo CLI so you can review it before installing.

Type: OpenClaw Skill Name: taskleef Version: 1.0.1 The skill is classified as suspicious due to its installation process, which involves downloading and executing an external binary (`todo` CLI) from `https://raw.githubusercontent.com/Xatter/taskleef/main/taskleef-cli/todo` as specified in `SKILL.md`. This introduces a supply chain risk, as the integrity of the external GitHub repository and the downloaded executable is critical. Additionally, the skill requires and handles a sensitive `TASKLEEF_API_KEY` environment variable, which, while necessary for its stated purpose, adds to the overall risk profile.