ClawHub
Back to skill

Security audit

TickTick CLI (ttg)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to manage TickTick tasks as advertised, but its installer runs unpinned code from an external GitHub repository and gives weak guidance for stored credentials.

Review the installer before use. Prefer installing ttg from a pinned, reviewed release or commit, and avoid running the automated install with elevated privileges. Store ~/.config/ttg/config.json with owner-only permissions, and be careful with delete commands because the skill can modify or remove TickTick tasks and checklist items.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Unpinned Remote Source Is Retrieved and Executed During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-16 and 23-26
Vulnerability Type: Remote payload retrieval and execution through an unpinned Git repository
Risk Level: High

Vulnerable Code

yaml
metadata:
  openclaw:
    requires:
      bins:
        - ttg
    install:
      - id: ttg
        kind: shell
        label: "Build and install ttg CLI from source"
        script: "git clone https://github.com/dhruvkelawala/ticktick-go /tmp/ttg-install && cd /tmp/ttg-install && make install && rm -rf /tmp/ttg-install"

The same unsafe installation pattern is also presented to users:

bash
git clone https://github.com/dhruvkelawala/ticktick-go
cd ticktick-go && make install

Technical Analysis

The installation instructions clone the mutable default branch of an external GitHub repository and immediately execute repository-controlled Makefile logic through make install. No reviewed commit, immutable release artifact, cryptographic checksum, or signature is specified.

Consequently, the effective code executed during installation can change after this Skill has been audited. A compromised upstream repository, maintainer account, or default branch could introduce arbitrary commands into the Makefile or build process. The repository URL is consistent with the declared TickTick CLI, so the audited file does not establish malicious intent; the vulnerability is the lack of integrity controls around remotely retrieved executable content.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing its default branch.
  2. The attacker modifies the Makefile, build scripts, or source-level initialization behavior.
  3. A user or agent invokes the Skill's installation script.
  4. git clone downloads the attacker-controlled revision without any commit or signature verification ...[truncated 885 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin installation to a specific, reviewed commit hash or immutable release version rather than the repository's default branch.
  • Prefer signed release artifacts and verify the maintainer's signature before installation.
  • Publish and verify a cryptographic checksum for every downloaded artifact.
  • Avoid executing build instructions directly from a freshly cloned mutable repository.
  • Perform builds in a restricted, temporary environment with minimal filesystem and network access.
  • Install without administrative privileges unless a documented operation strictly requires them.
  • Use a collision-resistant temporary directory created with mktemp -d, and ensure cleanup occurs through a shell trap.
  • Review the pinned Makefile and transitive dependencies before approving automated installation.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:29
Finding

TickTick Client Secret Is Stored Without Permission-Hardening Guidance

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-35
Vulnerability Type: Insecure storage of sensitive configuration
Risk Level: Medium

Vulnerable Code

markdown
Create `~/.config/ttg/config.json` with your TickTick API credentials (get them at [developer.ticktick.com](https://developer.ticktick.com/manage)):
```json
{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "timezone": "Europe/London"
}
text

### Technical Analysis

The Skill directs users to store a TickTick OAuth client secret in a plaintext JSON file but does not require owner-only permissions for either the configuration directory or the file. The resulting access permissions depend on the user's umask and the mechanism used to create the file.

On a multi-user system or in an environment with permissive defaults, another local account or process may be able to read the secret. Plaintext credential storage also increases exposure to overly broad backup, synchronization, diagnostic, or file-collection processes.

### Attack Path

1. A user follows the documentation and creates `~/.config/ttg/config.json`.
2. The file is created under a permissive umask or by a tool that grants group or other read access.
3. Another local user or process enumerates readable files beneath the user's configuration directory.
4. The attacker reads `client_id` and `client_secret` from the JSON file.
5. The attacker attempts to use the disclosed OAuth application credentials in flows permitted by the TickTick application configuration.

### Impact Assessment

Exploitation can disclose the TickTick OAuth client secret to local users or processes that should not have access to it. The exact account-level impact depends on TickTick's OAuth configuration and whether authorization codes, access tokens, refresh tokens, or other authentication material are also available.

Disclosure of the client secret alone does no
...[truncated 217 chars]
Remediation
View remediation

Remediation Suggestions

  • Require creation of the configuration directory with owner-only access:
    bash
    install -d -m 700 "$HOME/.config/ttg"
  • Require the configuration file to be owner-readable and owner-writable only:
    bash
    chmod 600 "$HOME/.config/ttg/config.json"
  • Create the file under a restrictive umask such as umask 077.
  • Prefer an operating-system credential manager or secret store instead of a plaintext JSON file where the CLI supports it.
  • Ensure authentication tokens receive the same or stronger protections.
  • Exclude credential files from source control, shared backups, logs, and diagnostic bundles.
  • Document credential rotation procedures for cases where the file may have been exposed.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- id: ttg
        kind: shell
        label: "Build and install ttg CLI from source"
        script: "git clone https://github.com/dhruvkelawala/ticktick-go /tmp/ttg-install && cd /tmp/ttg-install && make install && rm -rf /tmp/ttg-install"
---

# TickTick CLI Skill (`ttg`)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- id: ttg
        kind: shell
        label: "Build and install ttg CLI from source"
        script: "git clone https://github.com/dhruvkelawala/ticktick-go /tmp/ttg-install && cd /tmp/ttg-install && make install && rm -rf /tmp/ttg-install"
---

# TickTick CLI Skill (`ttg`)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- id: ttg
        kind: shell
        label: "Build and install ttg CLI from source"
        script: "git clone https://github.com/dhruvkelawala/ticktick-go /tmp/ttg-install && cd /tmp/ttg-install && make install && rm -rf /tmp/ttg-install"
---

# TickTick CLI Skill (`ttg`)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

cd ticktick-go && make install

text

Create `~/.config/ttg/config.json` with your TickTick API credentials (get them at [developer.ticktick.com](https://developer.ticktick.com/manage)):
```json
{
  "client_id": "YOUR_CLIENT_ID",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes deletion operations such as ttg task delete <id> and ttg task item-delete <task-id> <item-id> but does not warn that they remove user data or may be irreversible. Under the markdown-specific warning rule, user-facing documentation should disclose behaviors that can affect user data integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.