Is jdrhyne/todo-tracker safe?
Yes. jdrhyne/todo-tracker is safe to install. Oathe's behavioral security audit gave the todo-tracker skill by jdrhyne a trust score of 94/100 with 2 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/jdrhyne/todo-tracker
Is jdrhyne/todo-tracker safe to install?
The TODO Tracker skill is a legitimate utility for managing persistent TODO lists across agent sessions. It includes a well-written bash script for file operations but shows no signs of malicious behavior, data exfiltration, or security vulnerabilities.
What security issues were found in jdrhyne/todo-tracker?
Category Scores
Findings (2)
LOW Bash Script Execution -20 ▶
The skill includes an executable bash script (todo.sh) that performs file operations. While the script appears well-written and legitimate, any executable code presents inherent risk.
INFO Heartbeat Integration -5 ▶
The skill includes heartbeat integration that automatically triggers on system heartbeats to remind about stale items. This is documented behavior but represents automated agent interaction.
Should I install jdrhyne/todo-tracker?
Oathe's verdict for jdrhyne/todo-tracker is SAFE with a trust score of 94/100. Recommendation: Install.