awam-todo@0.7.2
CAUTIONPublisher claims: "Personal todo management skill. Parses natural-language todos from the session (task text, importance, urgency, note, workspace dir, related docs, links, due time), appends them to date-partitioned storage files, and auto-maintains an index (todo / in_progress / urgent / done / archived). Detects identical and near-duplicate tasks on add: identical → confirm to update the existing task (default), similar → confirm update, force-create, or cancel. Supports dependency chains (hard-blocked progress when prerequisites are unfinished — exit 3, AI asks the user, --force overrides) and subtasks (--parent; finishing a parent with open children is blocked). Each todo can carry an if-then contingency plan (blocker/counter) shown on cards. Overdue todos get two exits (advance now / reschedule via postpone). Overdue/stalled/due-today items are pinned with a reason. Storage is schema-versioned with migrate, plus monthly archiving. Weekly stats start on Monday; derived metrics show "N/A" when data is insufficient — never invent numbers. Missing tags are suggested read-only (suggest-tags) and confirmed before writing. storage_dir and editor are configurable via `env --set`; an optional local web UI (server.py) is prompted after mutations (ui.port / ui.prompt). Language policy: the AI conversation follows the user's language; CLI/API output is fixed English; the web UI is i18n (English default, switchable to Chinese; inline, offline-safe). A triage entry (`triage`) decides add / update / status / delete from one sentence with pure rules (no LLM), returns JSON, and asks for confirmation when unsure; an optional capture service (global hotkey reads the clipboard — no filtering, the clipboard text is used as the task text — feeds the triage entry and shows system dialogs for anything that needs confirmation or input) runs inside the web UI process and is managed from a Settings page (hotkey + triage-type toggles). Use when the user says 记一下/加个待办/帮我记/安排XX/提醒我X日做XX (or English equivalents: add a todo, remind me to …, note this down) or invokes /awam-todo; also for listing, completing, starting, reopening, archiving, setting dependencies, and managing subtasks." Observed in sandbox: static analysis only — behavior not yet observed.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-03 and scored it 51/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address; navigator.sendBeacon(). Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
What would make this Verified
29 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim awamwang: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- navigator.sendBeacon()≈ +4 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.