Todo Management 1.1.2

Per-workspace SQLite todo manager (./todo.db) with groups and task statuses (pending/in_progress/done/skipped), operated via {baseDir}/scripts/todo.sh for adding, listing, editing, moving, and removing entries and managing groups.

This appears to be a simple local todo script that only needs sqlite3. Before installing, (1) review the full todo.sh (the provided excerpt is mostly visible but the file was truncated in the listing) to confirm there are no network calls or eval/exec of user content; (2) ensure you do not set TODO_DB to a sensitive system path; (3) run the script in a safe test workspace to verify behavior (it will create/modify a local todo.db file); (4) the skill does not request credentials, but keep in mind the agent can run the script autonomously (normal behavior) — if you want to restrict that, disable autonomous invocation in your agent settings.

Type: OpenClaw Skill Name: todo-management-1-1-2 Version: 1.0.0 The core functionality of the skill, implemented in `scripts/todo.sh` and guided by `SKILL.md`, appears benign and well-secured against common vulnerabilities like SQL injection and prompt injection. However, the skill bundle contains `package.json`, `package-lock.json`, and `pnpm-lock.yaml` files which declare a dependency on a package named 'package-lock.json' from the npm registry. This is highly unusual and suspicious, as the skill is a bash script and does not utilize Node.js or pnpm, making these dependency files extraneous and potentially indicative of an attempt to introduce an unexpected or inert dependency into the bundle.