Telegram Todo List

Manage your TODO.md todo list via Telegram with commands to query, organize (add/edit/delete/move), and execute (complete) tasks.

This skill is internally inconsistent rather than obviously malicious: it claims to be a Telegram bot but contains only a local TODO.md manager and several buggy implementations (task numbering, delete, and timestamp handling). Before installing or enabling it for autonomous use, consider: 1) Do you need actual Telegram integration? If so, request or add secure Telegram API code and credentials handling. 2) Backup any existing /root/.openclaw/workspace/TODO.md — the skill will create/overwrite that file. 3) Review and test the script in a sandboxed environment (non-production workspace) to confirm behavior and fix bugs (marking complete, deleting, numbering, timestamps). 4) Ask the author to clarify purpose and provide a README or remove 'Telegram' from the name if it is only a helper library. Because of these mismatches and implementation issues, treat this skill cautiously and do not enable it with sensitive data or broad autonomous access until corrected.

Type: OpenClaw Skill Name: telegram-todolist Version: 1.0.1 The skill is classified as suspicious due to a prompt injection vulnerability. The `add_task` function in `scripts/todolist.py` allows user-provided input (`main_task`, `subtasks`) to be written directly into the `TODO.md` file without sanitization. Since `TODO.md` is a markdown file located in the agent's workspace (`/root/.openclaw/workspace/TODO.md`), an attacker could inject malicious markdown instructions into the todo list. If the OpenClaw agent later re-reads and interprets the content of `TODO.md` as instructions, this could lead to prompt injection, allowing an attacker to manipulate the agent's behavior beyond the skill's intended purpose.