Todo List 待办事项管理

待办事项管理技能，支持添加、查看、完成、删除待办事项，支持到期提醒、标签系统、项目管理、附件功能。触发条件：(1) 用户提到待办、Todo、任务管理、待办列表、todolist (2) 需要添加、查看、完成、删除待办事项 (3) 设置任务提醒 (4) 标签管理 (5) 项目管理 (6) 用户直接输入"todo"或...

This skill is functionally coherent for a local todo/reminder system using the OpenClaw CLI, but exercise caution before installing. What to check or do before installing: - Inspect and fix the shell deletion call: replace subprocess.run(f"openclaw cron delete {old_job_id}", shell=True, ...) with an args list (e.g. ['openclaw','cron','delete', old_job_id]) or otherwise sanitize/validate job IDs to remove command injection risk. - Review the implementation of attachment handling (add_attachment) to ensure it enforces the claimed path restrictions, prevents directory traversal and symlink TOCTOU attacks, enforces the 50MB limit, and sets safe permissions on copied files. - Ensure the memory directory (~/.openclaw/workspace/memory/) and session config files are accessible only by the intended user (restrict filesystem permissions) because reminders and job IDs are stored there and could be tampered with by other local users. - Be aware that the skill will create cron jobs via OpenClaw and send messages to configured channels/targets — verify your OpenClaw configuration and channel target are trusted before enabling reminders. - If you do not trust the skill owner/source, consider running the scripts in a restricted environment (container or dedicated account) or request a code revision that removes shell=True usage and provides audited attachment code. Confidence note: the assessment is based on the included SKILL.md and the provided Python sources; the todo.py file was large and partially truncated in the listing, so also review the remainder of that file (especially add_attachment and any other subprocess usage) for additional issues.

Type: OpenClaw Skill Name: todo-list Version: 1.3.0 The skill bundle is a functional todo list manager that supports task scheduling, tagging, project grouping, and file attachments. It uses the `openclaw` CLI for sending notifications and managing cron jobs. Security features are implemented in `scripts/todo.py`, such as path validation and size limits for attachments to prevent unauthorized file access. While some internal calls to `subprocess.run` still use `shell=True` (a potential vulnerability if local configuration files are tampered with), the overall logic is transparent, well-documented, and lacks any indicators of malicious intent or data exfiltration.