What to consider before installing: - The code implements a local task manager and appears to only read/write a JSON file at a configurable storagePath — that matches the description. - However, the skills SKILL.md contains metadata requesting always:true (force-inclusion). Ask the author why the plugin needs to be force-loaded for every agent session; prefer always:false unless there is a clear reason. - Registry metadata lacks an explicit install spec even though this package is a full npm project; the README instructs you to run npm install and build. Confirm how your OpenClaw installation will perform plugin installs and whether install scripts run automatically. - The package-lock contains many transitive libraries (AWS, Anthropic, etc.). This is likely benign (pulled in by the openclaw dependency), but it enlarges the supply chain. If you have strict policies, review the lockfile and run an npm audit and dependency review before installation. - Verify the configured storagePath and file permissions (default: ~/.openclaw/state/tasks/tasks.json) so the plugin only has access where you expect. Consider running the plugin in an environment or user account with limited filesystem scope if you have concerns. - If the author can confirm (a) the always:true metadata is accidental or can be removed, and (b) the transitive dependency set is expected (e.g., from openclaw), this would lower the risk and could change the assessment to benign. Confidence notes: assessment is medium confidence because the code is readable and matches its stated purpose, but the metadata/install inconsistencies and large transitive dependency tree are unexplained and warrant confirmation.