Todoist Task Manager

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a straightforward Todoist CLI wrapper, but users should understand it needs a Todoist API token and can change or delete tasks.

This skill appears coherent and purpose-aligned. Before installing, make sure you trust the Todoist CLI package, keep the Todoist API token private, and confirm any task deletion or bulk task changes before letting the agent run them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may be able to change or delete tasks if the user asks it to use these commands.

Why it was flagged

The skill documents commands that can modify, complete, or delete Todoist tasks. This is expected for a task manager, but users should be aware it can make persistent account changes.

Skill content

todoist modify TASK_ID --content "New title" ... todoist close TASK_ID ... todoist delete TASK_ID

Recommendation

Review requested task changes before allowing delete, complete, or bulk modification commands.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any process with access to that config file may be able to use the Todoist account through the CLI.

Why it was flagged

The skill requires a Todoist API token stored in a local config file. This is purpose-aligned for using the Todoist CLI, but the registry metadata does not separately declare a primary credential.

Skill content

Get your API token from https://app.todoist.com/app/settings/integrations/developer ... echo '{"token": "YOUR_API_TOKEN"}' > ~/.config/todoist/config.json

Recommendation

Store the token securely, avoid sharing the config file, and revoke or rotate the Todoist token if it may have been exposed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The installed CLI handles Todoist account access and task operations.

Why it was flagged

The skill depends on an external Homebrew-installed Todoist CLI. This is disclosed and central to the skill's purpose, but it means users rely on that package's provenance and behavior.

Skill content

Install: `brew install todoist-cli`

Recommendation

Install the CLI from a trusted Homebrew source and keep it updated.