TODO Tracker

Persistent TODO scratch pad for tracking tasks across sessions. Use when user says "add to TODO", "what's on the TODO", "mark X done", "show TODO list", "remove from TODO", or asks about pending tasks. Also triggers on heartbeat to remind about stale items.

Install only if you are comfortable with the agent maintaining a persistent local TODO.md file. Use explicit commands for add, done, and remove actions, and review TODO.md before deleting entries. Avoid passing complex regex-like text to mark-done or remove commands unless the script is hardened to treat input as plain text.

Type: OpenClaw Skill Name: todo-tracker Version: 1.0.0 The skill is classified as suspicious due to a potential Regular Expression Denial of Service (ReDoS) vulnerability in `scripts/todo.sh`. User-provided patterns for 'mark done' and 'remove item' commands are directly used in `grep` and `sed` regex operations without sufficient sanitization, which could allow a malicious or overly complex regex pattern to consume excessive CPU resources and lead to a denial of service. While the skill's core functionality is benign and involves local file operations, this specific implementation detail introduces a notable risk.