Todokan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:03 AM UTC
• Version: 1.3.2

Overview

The skill is mostly a disclosed Todokan task-management integration, but it documents an override that can expose tasks the user has not marked as visible to AI.

Review the AI visibility behavior before installing. Use the worker endpoint for least privilege when possible, avoid placing secrets or sensitive personal data in Todokan tasks, and do not enable workflows that query non-AI tasks unless you intentionally want the agent to see them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:245
• Finding: User-Controlled AI Visibility Gate Can Be Bypassed## Vulnerability Details **File Location**: `SKILL.md`, lines 245–251 **Vulnerability Type**: Authorization and task-level consent bypass **Risk Level**: High ### Vulnerable Code ```markdown ## AI Visibility Gate By default, the MCP server only returns tasks where `aiEnabled: true`. Tasks with `aiEnabled: false` are invisible to MCP agents — they will not appear in `list_tasks`, `search_across_habitats`, `get_events_since`, or `get_task`. Users control this via a **"Send to AI"** button on each task card. When clicked, it sets `aiEnabled: true`, `assignee: 'ai'`, and `status: 'doing'`. - To see only AI-assigned tasks: `list_tasks { "assignee": "ai" }` - To see all AI-enabled tasks: `list_tasks {}` (default — only AI-enabled tasks are returned) - To explicitly include non-AI tasks: `list_tasks { "aiEnabled": false }` (override, useful for reporting) ``` ### Technical Analysis The skill describes `aiEnabled` and the user-operated **Send to AI** action as a task-level visibility and consent boundary. Tasks for which `aiEnabled` is false are explicitly characterized as invisible to MCP agents. However, the skill then provides an override that directs the agent to call `list_tasks` with `"aiEnabled": false`. If the MCP server honors this parameter for ordinary agent credentials, the agent can retrieve tasks that the user deliberately did not enable for AI access. A default client-side filter is not an effective authorization control when the same client can disable or invert it. This violates least privilege and makes the purported AI visibility gate dependent on agent compliance rather than server-side authorization. ### Attack Path 1. A user creates or retains a task with `aiEnabled: false` and does not select **Send to AI**. 2. The agent loads the Todokan skill and obtains access through a configured MCP credential. 3. Instead of relying on the default AI-enabled task listing, the agent invokes: ```json { "aiEnabled": false } ``` 4. Th ...[truncated 892 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction that agents can request tasks with `"aiEnabled": false`. 2. Enforce `aiEnabled: true` on the MCP server for all standard agent credentials, regardless of client-supplied filters. 3. Reject requests that explicitly set `aiEnabled` to false unless the credential has a separate, narrowly defined administrative scope. 4. If broader reporting is required, use a distinct tool or authorization scope and require explicit, informed user confirmation before every query. 5. Ensure related APIs—including `list_tasks`, `get_task`, `search_across_habitats`, `get_events_since`, document access, and comment access—apply the same server-side visibility policy. 6. Add authorization tests proving that ordinary planner and worker credentials cannot retrieve or infer non-AI-enabled tasks through direct IDs, filters, searches, event feeds, pagination, counts, or related-resource endpoints. 7. Record denied override attempts in security logs and monitor repeated attempts to access non-AI-enabled data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes connecting an external MCP service with full CRUD access to tasks and running polling workflows, but it does not clearly warn users that the skill can modify remote data and send task content plus API credentials to a third-party service. In an agent-skill context, that omission matters because users may install it expecting local task management semantics while actually granting broad remote access and ongoing data synchronization.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Verify MCP connectivity:

```bash
curl -s https://todokan.com/mcp \
  -H "Authorization: Bearer kb_live_..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.