Todoist CLI

• Analyzed: May 13, 2026, 3:00 AM
• Findings: 1
• Version: 1.3.0
• Hash: f32841a9a563fe5cfb37c2725a68e7a8ff881a03adb792518ff374b92a65a13f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle for 'todoist-cli' is benign. The `_meta.json` provides standard metadata. The `skill.md` clearly defines the skill's purpose, installation methods (via brew or go install from GitHub), and usage examples, all focused on managing Todoist tasks. There are no indications of prompt injection attempts against the AI agent, no commands designed for data exfiltration, persistence, or unauthorized execution. The required `TODOIST_API_TOKEN` is a legitimate credential for the tool's intended function.