Ticktick Linux

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:36 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a straightforward TickTick CLI wrapper, but its command templates expose user-provided task fields to shell injection risk.

Review before installing. This skill should only be used in a controlled environment with trusted task input unless its commands are changed to use shell-free argument arrays or robust escaping and validation. Expect it to use your TickTick CLI credentials and modify TickTick task data when creating or completing tasks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27

Finding

Shell Command Injection Through Unsafely Interpolated Tool Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-32, 47-55, and 66-69
Vulnerability Type: OS command injection through shell command templates
Risk Level: High

The skill directly interpolates caller-controlled values into shell commands. Several values are enclosed in double quotes, while status and priority are not quoted at all.

bash

/home/david/.cargo/bin/tickrs task list --json \
  {{#if project}}--project-name "{{project}}"{{/if}} \
  {{#if status}}--status {{status}}{{/if}}

bash

/home/david/.cargo/bin/tickrs task create --json \
  --title "{{title}}" \
  {{#if content}}--content "{{content}}"{{/if}} \
  {{#if date}}--date "{{date}}"{{/if}} \
  {{#if project}}--project-name "{{project}}"{{/if}} \
  {{#if priority}}--priority {{priority}}{{/if}}

bash

/home/david/.cargo/bin/tickrs task complete "{{id}}" --json

Technical Analysis

The dynamic parameters project, status, title, content, date, priority, and id are embedded in command strings without shell-safe argument handling.

Double quotes do not provide adequate protection when an attacker can inject a double quote that terminates the intended argument. The attacker may then append shell metacharacters and an arbitrary command. For example, a malicious title shaped like:

text

"; arbitrary_command; #

can terminate the --title value, introduce another command, and comment out the remaining generated command. The unquoted status and priority substitutions are even more directly exposed to shell separators, expansions, redirections, and substitutions.

The documented enum restrictions for status and priority do not establish that runtime validation is enforced. Therefore, they cannot be relied upon as a security boundary.

Attack Path

1. An attacker or untrusted caller supplies a crafted value for a tool parameter such as title, content, project, id, ...[truncated 1526 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell command strings with interpolated parameters. Invoke /home/david/.cargo/bin/tickrs directly through an execution API that accepts a program path and an argument array, with shell processing disabled.

   text

   executable: /home/david/.cargo/bin/tickrs
   arguments: ["task", "create", "--json", "--title", title]
   shell: false
   

2. Append optional flags and their values as separate argument-array elements. Never concatenate user input with flag syntax.

3. Enforce strict allowlists for enumerated fields:

   • status: only incomplete or complete
   • priority: only none, low, medium, or high

4. Validate task IDs against the exact format emitted by tickrs. Reject values containing whitespace, quotes, control characters, or shell metacharacters.

5. Apply reasonable length and character restrictions to project names, titles, content, and dates. Treat these checks as defense in depth rather than a substitute for shell-free execution.

6. If a shell is absolutely unavoidable, use a proven argument-escaping routine for the exact target shell on every dynamic value. Do not implement escaping through simple quote replacement.

7. Add negative tests using quotes, semicolons, command substitutions, newlines, redirections, and backticks to verify that malicious input is passed only as literal data.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description at L04 says the skill manages TickTick tasks via add, list, and complete operations. However, the documented tools also include ticktick_projects, which lists all projects (L71-L77), a capability outside the stated task-only scope. This is a small but real mismatch between the claimed behavior and the documented implementation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.