topydo

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is a coherent todo.txt/topydo command reference, with expected local task-file mutation and package installation guidance.

This skill appears safe for its purpose as a topydo/todo.txt command guide. Before installing, verify the topydo package source, and before use, confirm any commands that delete, archive, edit, sort, or bulk-complete tasks.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used without care, the assistant could remove or alter tasks in the user’s todo.txt file.

Why it was flagged

The skill documents commands that can delete or bulk-modify todo.txt entries. This is expected for a task manager, but users should review before running destructive commands.

Skill content

Delete by ID:
```bash
topydo del 1
```

Delete multiple:
```bash
topydo del 1 2 3
```

Delete by expression:
```bash
topydo del -e completed:today
```

Recommendation

Confirm the intended task IDs or filters before running delete, edit, archive, sort, or bulk completion commands.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing external packages adds normal dependency and provenance risk, especially when versions are not pinned.

Why it was flagged

The skill instructs users to install an external CLI package, including optional extras. This is central to the stated purpose, but the registry has no install spec and the package versions are not pinned.

Skill content

pip3 install topydo
...
pip3 install 'topydo[columns,prompt,ical]'
...
sudo apt install python3-pip && pip3 install topydo

Recommendation

Install topydo from trusted package repositories and consider pinning or verifying the package version before use.