Security audit

Todo Planner

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local todo logger with disclosed local storage, but users should treat its plaintext logs and exports as sensitive.

Install only if you are comfortable with a local plaintext task log under ~/.local/share/todo-planner. Avoid storing secrets or highly sensitive personal/work details, review local file permissions on shared systems, and be careful opening CSV exports in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Locally Stored Task Data May Be Created with Overly Permissive Permissions
Content: View full analysis
> "$DATA_DIR/add.log" local total=$(wc -l < "$DATA_DIR/add.log") echo " [Todo Planner] add: $input" echo " Saved. Total add entries: $total" _log "add" "$input" ``` ### Technical Analysis The script creates its data directory and log files without establishing a restrictive `umask` or explicitly applying secure permission modes. File permissions therefore depend on the invoking process's environment. With a common `umask` of `022`, a newly created directory is normally mode `0755`, while log and export files are normally mode `0644`. If the user's home-directory permissions permit traversal, other local accounts may be able to read task descriptions, plans, reminders, reviews, activity history, and exported records. The application documentation states that data remains local, but local storage alone does not ensure confidentiality from other operating-system users. ### Attack Path 1. A victim invokes the Skill and records sensitive task, reminder, planning, or review information. 2. The script creates `~/.local/share/todo-planner` and its files using the victim's ambient `umask`. 3. Under a permissive `umask`, the directory and files receive group-readable or world-readable permissions. 4. A different local account with permission to traverse the victim's home directory accesses files such as: - `~/.local/share/todo-planner/add.log` - `~/.local/share/todo-planner/remind.log` - `~/.local/share/todo-planner/history.log` - `~/.local/share/todo-planner/export.csv` ...[truncated 611 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:55
Finding: Unescaped User Input Produces Unsafe JSON and CSV Exports
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` ### Technical Analysis The exporter inserts task values directly into JSON strings without escaping quotation marks, backslashes, or control characters. An input containing characters such as `"` can terminate the intended JSON string and alter the generated document's structure. At minimum, this creates invalid JSON; in downstream systems that trust the generated file, it can also introduce attacker-controlled properties or objects. The CSV exporter similarly writes values without RFC 4180 quoting. Commas, quotation marks, and embedded line breaks can alter rows and columns. More importantly, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the exported file is opened in spreadsheet software. This is a data-format injection issue rather than shell command injection: the shell consistently quotes `$val` at the point of output, so the supplied task text is not executed directl ...[truncated 1931 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description suggests a functional todo organizer with concrete task-management features such as priorities, deadlines, weekly views, progress tracking, and overdue-item review. The code instead acts as a generic local note/log collector: each command simply appends timestamped free-form input to a corresponding .log file and can display recent entries. There is no data model for todos, no parsing or enforcement of priorities/deadlines, no overdue detection, and no weekly view generation. Additionally, the script includes undeclared capabilities like export, search, stats, status, and several extra command categories (archive, tag, timeline, streak, remind, report). While the general productivity theme overlaps somewhat, the implemented behavior is materially broader and less specific than the declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use the skill when "adding tasks, planning agendas, tracking progress, reviewing overdue items," which are common, high-level activities that overlap with ordinary conversation and many unrelated workflows. It does not define specific trigger phrases, constraints, or exclusion conditions, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly stores arbitrary task content in local log files and supports export, but it does not clearly warn users that potentially sensitive notes, reminders, and plans will persist on disk and be included in exported files. In a productivity skill, users often enter personal, business, or operational details, so silent persistence and exportability increases the risk of accidental data exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a task organizer for managing priorities, deadlines, agendas, progress, and overdue items. In the code, commands such as add, plan, track, review, prioritize, timeline, and weekly-review simply append free-form input to separate log files, with no parsing or handling of priorities, deadlines, weekly views, or overdue-state logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script persistently stores all user-provided content in plaintext under ~/.local/share/todo-planner and also appends activity to a history log, without any disclosure, retention controls, or sensitivity checks. Todo items often contain personal schedules, locations, credentials-adjacent notes, or work details, so silent persistence increases the risk of local privacy exposure on shared or compromised systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The export functionality aggregates every .log file in the data directory into json/csv/txt outputs, including history and all command logs. While some reporting is compatible with productivity tooling, this script behaves more like a generic personal log archiver than a task planner, and that broad data-export capability is not clearly justified by the manifest's narrower todo-organization scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.