todo-tracker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited todo-tracker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Maintain a portable Markdown task file without a service or database. Use the bundled script for every operation; do not edit task lines with ad hoc regex commands.
Runtime requirements: Bash and standard awk, cp, chmod, mkdir, mktemp, and mv utilities. Tasks are stored in a user-configurable local Markdown file.
TODO_FILE selects the task file. Default: TODO.md in the current workspace.{baseDir} so execution does not depend on the current directory.600, and a recoverable previous-state backup at ${TODO_FILE}.bak.${TODO_FILE}.next-id is an adjacent mode-600 monotonic ID counter. Keep it with the task file when moving or restoring the tracker; backup rotation must not replace or delete it.TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" listDo not use a machine-specific path. Quote TODO_FILE, IDs, and item text.
New tasks receive monotonic IDs such as T000001. Task text is matched literally and exactly, never as a regex or substring.
${TODO_FILE}.bak, and any valid existing counter. It reserves and atomically persists the next counter value before publishing a task-file mutation, so a crash may create an ID gap but cannot reuse an ID.0600 counter fails closed; do not delete or reset it to bypass the check.done and always use an ID for approved removal.TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" list
TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" list high
TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" summaryIf the file does not exist, list reports that fact and summary returns zero counts. Neither creates state.
TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" add high "Review launch checklist"Priority must be high, medium, or low. Capture the returned stable ID.
TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" done T000001Exact text is accepted only when it identifies one open task. Completion preserves the stable ID and moves the task to Done.
Removal is destructive and requires an exact preview plus action-time approval.
${TODO_FILE}.bak, and no task is removed: TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" remove "exact task text"The command exits without removal and prints the exact stable ID. Repeating the operation uses the persisted ID rather than migrating or advancing the counter again.
TODO_FILE="$PWD/TODO.md" bash "{baseDir}/scripts/todo.sh" remove T000001 --confirm T000001Never infer approval from a partial name, prior unrelated removal, or a bulk request. Remove tasks one exact stable ID at a time.
Heartbeat access is off by default. Enable it only when the user explicitly opts in by configuring TODO_HEARTBEAT_ENABLED=1 for that heartbeat workflow.
TODO_FILE="$PWD/TODO.md" TODO_HEARTBEAT_ENABLED=1 \
bash "{baseDir}/scripts/todo.sh" heartbeatHeartbeat output contains counts only: total, high, medium, low, and stale. It never prints task titles or notes. Do not create a schedule merely because this skill is installed.
# TODO Tracker
*Last updated: 2026-08-29*
## 🔴 High Priority
- [ ] [T000001] Review launch checklist (added: 2026-08-29)
## 🟡 Medium Priority
## 🟢 Nice to Have
## ✅ Done
- [x] [T000002] Verify release notes (done: 2026-08-29)If a write fails because the lock exists, do not remove the lock while another process may be active. Investigate the writer and retry only after the lock is known to be stale.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.