ClawHub
Back to skill

Security audit

Todoist

Security checks across malware telemetry and agentic risk

Overview

This Todoist skill is a disclosed Maton-gateway integration that can read and change Todoist data with user approval, with credential risks called out rather than hidden.

Install only if you are comfortable routing Todoist access through Maton. Prefer OAuth through the Maton CLI, confirm every write or delete before it runs, specify the intended connection when multiple accounts exist, and avoid the raw MATON_API_KEY curl fallback unless you are in a controlled environment without the CLI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill includes a documented fallback that requires direct handling of a long-lived API key in process environment and raw HTTP requests, which expands the trust boundary beyond the managed-OAuth CLI model described elsewhere. Even though the section warns against common leakage paths, it still normalizes secret handling in agent-executed environments where child processes, logs, crash dumps, or misused headers can expose credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
Everything above uses the CLI, which holds the credential itself and never exposes it to the caller. Use the raw HTTP form below **only** where the CLI cannot be installed — a locked-down container, a CI step, a sandbox with no package manager. If `maton` is available, `maton api` does the same job without handling a secret.

Calling `https://api.maton.ai/` directly means holding a long-lived Maton API key in the process environment, where it is readable by every child process and easy to leak into logs, crash dumps, shell history, and pasted output. Handle it accordingly:

- **Never print, echo, or log the key**, and never include it in output shown to the user. Check for presence, never for value:
Confidence
83% confidence
Finding
The skill instructs direct transmission to an external endpoint using a bearer credential, which is a sensitive operation in an agent skill because it creates a path for credential exposure and external data exfiltration if misused. Although the endpoint is the expected Maton service and the section includes safeguards, the design still enables outbound secret-bearing requests outside the safer encapsulation of the CLI.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.