ClawHub
Back to skill

Security audit

4todo

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for managing 4todo tasks, but its documented curl pattern can expose the API token locally despite claiming leak-resistant handling.

Review before installing if you plan to use a real 4todo token. Use a narrowly scoped, revocable token if available, avoid shared hosts where process arguments may be visible to other users, and manually confirm any recurring-task deletions or account-changing actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:133
Finding

Bearer Token Exposed Through curl Process Arguments

Content
View full analysis
/cmdline` or process-monitoring output while curl is running. This conflicts with the Skill's stated objective of using leak-resistant secret injection. The outbound API communication itself is consistent with the declared functionality: task data and authentication credentials are sent only to the documented HTTPS endpoint at `https://4to.do/api/v0`. No transmission ...[truncated 1586 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- `curl` must be available on `PATH` (and inside the sandbox container, if the agent is sandboxed).

## User-facing output rules (important)

- Be non-technical by default. Focus on outcomes, not implementation.
  - Avoid mentioning: curl, endpoints, headers, API mechanics, JSON payloads, config patches.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

  • Always pass the token via FOURTODO_API_TOKEN (never paste tokens into chat).
bash
curl -sS -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" "https://4to.do/api/v0/workspaces"
curl -sS -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" "https://4to.do/api/v0/todos?workspace=ws_...&show=all"
curl -sS -X POST -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" -H "Content-Type: application/json" --data-raw '{"name":"...","quadrant":"IU","workspace_id":"ws_..."}' "https://4to.do/api/v0/todos"
curl -sS -X POST -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" "https://4to.do/api/v0/todos/todo_.../complete"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 191)May include surrounding context.

md
**Request Body:**

| Field          | Type   | Required | Description                                                                                |
| -------------- | ------ | -------- | ------------------------------------------------------------------------------------------ |
| `name`         | string | Yes      | Todo item name                                                                             |
| `quadrant`     | string | Yes      | Quadrant type: `IU`, `IN`, `NU`, or `NN`                                                   |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 213)May include surrounding context.

Example Request (curl):

bash
curl -sS -X POST -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" -H "Content-Type: application/json" --data-raw '{"name":"Complete project proposal","quadrant":"IU","workspace_id":"ws_01hqk8z9w3r2n1p0m4v5x7y6"}' "https://4to.do/api/v0/todos"

Example Response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 292)May include surrounding context.

Example Request (curl):

bash
curl -sS -X POST -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" -H "Content-Type: application/json" --data-raw '{"name":"Complete project proposal","quadrant":"IU","workspace_id":"ws_01hqk8z9w3r2n1p0m4v5x7y6"}' "https://4to.do/api/v0/todos"

Example Response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 385)May include surrounding context.

Example Request (curl):

bash
curl -sS -X POST -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" -H "Content-Type: application/json" --data-raw '{"name":"Complete project proposal","quadrant":"IU","workspace_id":"ws_01hqk8z9w3r2n1p0m4v5x7y6"}' "https://4to.do/api/v0/todos"

Example Response:

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 372)May include surrounding context.

md
**Request Body:**

| Field       | Type    | Required    | Description                                                                                       |
| ----------- | ------- | ----------- | ------------------------------------------------------------------------------------------------- |
| `title`     | string  | Yes         | Recurring todo title                                                                              |
| `quadrant`  | string  | Yes         | Quadrant type: `IU`, `IN`, `NU`, or `NN`                                                          |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_v0.md (reported line 486)May include surrounding context.

Example Request (curl):

bash
curl -sS -X PUT -H "Authorization: Bearer $FOURTODO_API_TOKEN" -H "Accept: application/json" -H "Content-Type: application/json" --data-raw '{"title":"Morning standup","quadrant":"IU","frequency":"daily","timezone":"America/Los_Angeles"}' "https://4to.do/api/v0/recurring-todos/rec_todo_01hqk8z9w3r2n1p0m4v5x7y6"

Example Response:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a DELETE operation for recurring todos, but the description only notes that future instances stop being created. It does not explicitly warn users that deleting the recurring todo may be irreversible or affect scheduled task generation, which is a system/data-impacting behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.