tasktodolist

Manage multiple independent to-do lists with commands to add, list, complete, remove, clear tasks, and manage task lists by name.

This appears to be a straightforward local todo CLI. Before installing: (1) verify the package source you are installing from (the registry metadata owner is shown but there's no homepage); (2) inspect package.json and src/index.js (the package runs a harmless postinstall chmod and installs a CLI binary when installed globally); (3) be aware that todos are stored as plain JSON under ~/.tasktodolist — do not store sensitive secrets there; (4) if uncomfortable with global install, run npm install locally and review files before running; (5) the version number discrepancy (registry 1.0.1 vs package.json 1.0.0) is likely minor but worth confirming with the publisher.

Type: OpenClaw Skill Name: tasktodolist Version: 1.0.1 The skill implements a functional todo list manager but contains a path traversal vulnerability in `src/index.js`. The `--task` argument is used to construct file paths via `path.join` without sanitization, allowing potential access to files outside the intended `~/.tasktodolist` directory if directory traversal sequences (e.g., `../`) are provided. While the logic appears aligned with its stated purpose and lacks clear malicious intent, this vulnerability represents a security flaw.