Todokan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:03 AM UTC
• Version: 1.3.2

Overview

The skill is mostly a disclosed Todokan task-management integration, but it documents an override that can expose tasks the user has not marked as visible to AI.

Review the AI visibility behavior before installing. Use the worker endpoint for least privilege when possible, avoid placing secrets or sensitive personal data in Todokan tasks, and do not enable workflows that query non-AI tasks unless you intentionally want the agent to see them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:245

Finding

User-Controlled AI Visibility Gate Can Be Bypassed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 245–251
Vulnerability Type: Authorization and task-level consent bypass
Risk Level: High

Vulnerable Code

markdown

## AI Visibility Gate

By default, the MCP server only returns tasks where `aiEnabled: true`. Tasks with `aiEnabled: false` are invisible to MCP agents — they will not appear in `list_tasks`, `search_across_habitats`, `get_events_since`, or `get_task`.

Users control this via a **"Send to AI"** button on each task card. When clicked, it sets `aiEnabled: true`, `assignee: 'ai'`, and `status: 'doing'`.

- To see only AI-assigned tasks: `list_tasks { "assignee": "ai" }`
- To see all AI-enabled tasks: `list_tasks {}` (default — only AI-enabled tasks are returned)
- To explicitly include non-AI tasks: `list_tasks { "aiEnabled": false }` (override, useful for reporting)

Technical Analysis

The skill describes aiEnabled and the user-operated Send to AI action as a task-level visibility and consent boundary. Tasks for which aiEnabled is false are explicitly characterized as invisible to MCP agents.

However, the skill then provides an override that directs the agent to call list_tasks with "aiEnabled": false. If the MCP server honors this parameter for ordinary agent credentials, the agent can retrieve tasks that the user deliberately did not enable for AI access. A default client-side filter is not an effective authorization control when the same client can disable or invert it.

This violates least privilege and makes the purported AI visibility gate dependent on agent compliance rather than server-side authorization.

Attack Path

1. A user creates or retains a task with aiEnabled: false and does not select Send to AI.
2. The agent loads the Todokan skill and obtains access through a configured MCP credential.
3. Instead of relying on the default AI-enabled task listing, the agent invokes:

   json

   {
     "aiEnabled": false
   }
   

4. Th ...[truncated 892 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that agents can request tasks with "aiEnabled": false.
2. Enforce aiEnabled: true on the MCP server for all standard agent credentials, regardless of client-supplied filters.
3. Reject requests that explicitly set aiEnabled to false unless the credential has a separate, narrowly defined administrative scope.
4. If broader reporting is required, use a distinct tool or authorization scope and require explicit, informed user confirmation before every query.
5. Ensure related APIs—including list_tasks, get_task, search_across_habitats, get_events_since, document access, and comment access—apply the same server-side visibility policy.
6. Add authorization tests proving that ordinary planner and worker credentials cannot retrieve or infer non-AI-enabled tasks through direct IDs, filters, searches, event feeds, pagination, counts, or related-resource endpoints.
7. Record denied override attempts in security logs and monitor repeated attempts to access non-AI-enabled data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes connecting an external MCP service with full CRUD access to tasks and running polling workflows, but it does not clearly warn users that the skill can modify remote data and send task content plus API credentials to a third-party service. In an agent-skill context, that omission matters because users may install it expecting local task management semantics while actually granting broad remote access and ongoing data synchronization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

• Verify MCP connectivity:

bash

curl -s https://todokan.com/mcp \
  -H "Authorization: Bearer kb_live_..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Static analysis

No suspicious patterns detected.