Todoist Task Manager
v1.0.0Manage Todoist tasks via the `todoist` CLI (list, add, modify, complete, delete). Supports filters, projects, labels, and priorities.
⭐ 3· 2.5k·10 current·10 all-time
byMarius Wichtner@2mawi2
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description, required binary (todoist) and the Homebrew install (todoist-cli) match the claimed purpose of managing Todoist tasks. Minor inconsistency: SKILL.md requires a Todoist API token stored in ~/.config/todoist/config.json, but the registry metadata lists no required credentials or primaryEnv.
Instruction Scope
SKILL.md only instructs standard Todoist CLI operations (install, add/list/modify/close/delete, sync) and where the CLI stores config/cache. It does not ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints.
Install Mechanism
Install is via a Homebrew formula (todoist-cli). This is a low-risk, expected distribution channel for a CLI tool and matches the declared bin.
Credentials
No environment variables are declared in the metadata, but SKILL.md instructs storing a Todoist API token in a plain JSON config file (~/.config/todoist/config.json). The requested credential is proportionate to the task, but its absence from declared requirements and the use of an unencrypted config file are worth noting.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and requires only normal installation. Autonomous invocation is allowed by default (platform normal), but that is not combined with other high-risk requests here.
Assessment
This skill appears to do what it says: it uses the todoist-cli to manage tasks. Before installing, check the Homebrew formula source (and the linked GitHub repo) to ensure the CLI is the official project. Be aware that the SKILL.md tells you to store your Todoist API token in ~/.config/todoist/config.json (plain JSON) and that the CLI also keeps a cache at ~/.config/todoist/cache.json—these files contain your token and local data, so store them only on trusted machines. If you want to limit risk: create a dedicated Todoist API token with minimal scope (if possible), keep a backup plan to revoke the token, and avoid enabling autonomous agent use of the skill unless you trust the agent and environment. Finally, consider inspecting the todoist-cli code (or Homebrew formula) if you need higher assurance that the installed binary behaves as expected.Like a lobster shell, security has layers — review code before you run it.
latestvk97e5hm1288s1apsy791hnxbcx7ztnvt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
✅ Clawdis
Binstodoist
Install
Install todoist-cli via Homebrew
Bins: todoist
brew install todoist-cli