TickTick

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate TickTick helper, but it needs Review because it combines a full-access TickTick token with shell execution, inconsistent quoting examples, and an unpinned global CLI install.

Install only if you are comfortable giving the server-side CLI full access to your TickTick account. Pin and review the CLI package if possible, keep the token out of chat/logs/files, require safe argument passing or robust shell escaping for all user text and tokens, and keep confirmation enabled for destructive or bulk changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-reference.md:24

Finding

Shell Command Injection Through Unsafe Double-Quoted User Input

Content

View full analysis

ticktick task create --title "Buy milk" --project ticktick task create --title "Meeting" --project \ --priority 5 --due-date "2026-08-10T09:00:00-0500" ticktick task create --title "Review" --project --tags work,urgent # taskId is passed twice — positional and --id. Both are required. ticktick task update --id --project --title "Updated" ``` `references/cli-reference.md:61-69`: ```bash ticktick project list ticktick project get ticktick project data # project + open tasks + columns ticktick project create --name "Work" --color "#F18181" --view-mode list --kind TASK ticktick project update --name "New Name" --color "#4AB8A9" ticktick project delete ticktick project group list # folders ticktick project group create --name "Work" ``` `references/cli-reference.md:94-96`: ```bash ticktick habit list ticktick habit get ticktick habit create --name "Drink water" --goal 8 --unit cups \ --repeat "RRULE:FREQ=DAILY;INTERVAL=1" ``` ### Technical Analysis The reference states that user-supplied text must be protected before reaching the shell, but numerous executable examples place text fields in double quotes. POSIX shell double quotes prevent word splitting but do not prevent command substitution through `$(...)` or backticks. If an agent replaces an example title or name with raw user input, a value such as `$(touch /tmp/injected)` is evaluated by the shell before the `ticktick` process starts. The same issue applies to other user-controlled values documented using this pa ...[truncated 1305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/setup.md:38

Finding

Shell Command Injection Through Unquoted Authentication Token

Content

View full analysis

ticktick auth status ``` ### Technical Analysis The setup procedure instructs the agent to place an authentication token directly into a shell command without quoting or validating it. The token may arrive through a user-controlled messaging channel. If the supplied value contains shell metacharacters, the shell can interpret them as command separators, substitutions, redirections, or pipelines rather than as part of a single token argument. For example, a supplied value structured as `value; malicious-command` could cause the shell to execute the additional command. Passing the secret on the command line may also expose it through process inspection, command auditing, or execution logs, depending on the runtime configuration. ### Attack Path 1. Authentication fails and the agent follows the token-based recovery procedure. 2. An attacker or compromised user supplies a crafted value in place of a legitimate API token. 3. The agent substitutes that value into `ticktick auth token ` as an unquoted shell command. 4. The shell parses attacker-controlled metacharacters. 5. The appended or substituted command executes with the privileges of the agent service account. ### Impact Assessment Exploitation can provide arbitrary command execution under the agent account, giving access to files, environment variables, locally stored credentials, network capabilities, and TickTick data available to that account. Separately, a legitimate full-access TickTick token may be exposed to local process observers or command-logging infrastructure if it is passed visibly on the command line. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global npm Dependency Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

ticktick task create --title 'Pagar la luz' --project

text

Never paste a raw message straight into a command string. This is a server with shell access; a task titled `foo; rm -rf ~` should create a task with a silly name, not delete a home directory.

## Everything needs a project ID

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

ticktick task create --title 'Pagar la luz' --project

text

Never paste a raw message straight into a command string. This is a server with shell access; a task titled `foo; rm -rf ~` should create a task with a silly name, not delete a home directory.

## Everything needs a project ID

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

ticktick task create --title 'Pagar la luz' --project

text

Never paste a raw message straight into a command string. This is a server with shell access; a task titled `foo; rm -rf ~` should create a task with a silly name, not delete a home directory.

## Everything needs a project ID

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 43)May include surrounding context.

ticktick auth status

text

The token is a full-access credential for the user's task data. Don't echo it back in chat, don't write it into logs, notes, or workspace files, and don't include it in a summary. If it arrives in a Telegram message, use it and move on without repeating it — that chat history is stored.

## Auth subcommands

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reference instructs agents to force all ISO datetimes to UTC-5 for this user, rather than deriving timezone from the user's actual preference, locale, or explicit input. This can cause tasks, reminders, focus sessions, and date-bounded queries to execute at the wrong times or omit/include incorrect records, especially around travel, DST changes, or integrations that expect true local time.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 15)May include surrounding context.

ticktick --version

text

If the global install fails with `EACCES`, the npm global prefix isn't writable by this user. Don't reach for `sudo npm -g` — it creates root-owned files under a systemd *user* service and breaks later upgrades. Use a user-owned prefix:

```bash
mkdir -p ~/.npm-global

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 18)May include surrounding context.

If the global install fails with EACCES, the npm global prefix isn't writable by this user. Don't reach for sudo npm -g — it creates root-owned files under a systemd user service and breaks later upgrades. Use a user-owned prefix:

bash

mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
export PATH="$HOME/.npm-global/bin:$PATH"   # add to ~/.zshrc

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

bash

mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
export PATH="$HOME/.npm-global/bin:$PATH"   # add to ~/.zshrc

This skill declares requires.bins: ["ticktick"], so OpenClaw only loads it when ticktick is on the gateway's PATH. If the skill doesn't appear in openclaw skills list, a missing or non-PATH binary is the first thing to check — not a problem with the skill file.