Skills/ClawHub/awam-todo

awam-todo@0.7.1

CAUTION

Publisher claims: "Personal todo management skill. Parses natural-language todos from the session (task text, importance, urgency, note, workspace dir, related docs, links, due time), appends them to date-partitioned storage files, and auto-maintains an index (todo / in_progress / urgent / done / archived). Detects identical and near-duplicate tasks on add: identical → confirm to update the existing task (default), similar → confirm update, force-create, or cancel. Supports dependency chains (hard-blocked progress when prerequisites are unfinished — exit 3, AI asks the user, --force overrides) and subtasks (--parent; finishing a parent with open children is blocked). Each todo can carry an if-then contingency plan (blocker/counter) shown on cards. Overdue todos get two exits (advance now / reschedule via postpone). Overdue/stalled/due-today items are pinned with a reason. Storage is schema-versioned with migrate, plus monthly archiving. Weekly stats start on Monday; derived metrics show "N/A" when data is insufficient — never invent numbers. Missing tags are suggested read-only (suggest-tags) and confirmed before writing. storage_dir and editor are configurable via `env --set`; an optional local web UI (server.py) is prompted after mutations (ui.port / ui.prompt). Language policy: the AI conversation follows the user's language; CLI/API output is fixed English; the web UI is i18n (English default, switchable to Chinese; inline, offline-safe). A triage entry (`triage`) decides add / update / status / delete from one sentence with pure rules (no LLM), returns JSON, and asks for confirmation when unsure; an optional capture service (global hotkey reads the clipboard — no filtering, the clipboard text is used as the task text — feeds the triage entry and shows system dialogs for anything that needs confirmation or input) runs inside the web UI process and is managed from a Settings page (hotkey + triage-type toggles). Use when the user says 记一下/加个待办/帮我记/安排XX/提醒我X日做XX (or English equivalents: add a todo, remind me to …, note this down) or invokes /awam-todo; also for listing, completing, starting, reopening, archiving, setting dependencies, and managing subtasks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher awamwang · joined 2 days agoInstalls 296Last detonated 40 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Outbound HTTP to raw IP addressscripts/todo.py:2917 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/todo.py:2991 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressscripts/todo.py:2949 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressSKILL.md:786 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:786 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/selftest.py:25 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
navigator.sendBeacon()web/index.html:1652 · navigator.sendBeacon() — can silently exfiltrate dataFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addressscripts/todo.py:2917 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/todo.py:533 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedweb/server.py:397 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedweb/server.py:394 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedweb/server.py:374 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressscripts/todo.py:2949 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedweb/server.py:376 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim awamwang: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. navigator.sendBeacon()≈ +4 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim awamwang