Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TickTick CLI (ttg)

v1.1.1

Manage TickTick tasks and projects via the `ttg` CLI (github.com/dhruvkelawala/ticktick-go). Full CRUD, checklists/subtasks with progress display, reminders,...

0· 345·0 current·0 all-time
byDhruv Kelawala@dhruvkelawala
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (TickTick CLI via the ttg tool) matches the runtime instructions which call the ttg binary and demonstrate task operations. However, the SKILL.md instructs the user to create ~/.config/ttg/config.json containing client_id/client_secret (secrets needed for TickTick access), yet the skill metadata declares no required env vars or config paths; this mismatch should be clarified.
!
Instruction Scope
SKILL.md stays focused on ttg usage, but it explicitly references a user config file path (~/.config/ttg/config.json) and an OAuth login flow. Those file/credential requirements are not declared in the skill metadata. Also the embedded install script (in the SKILL.md frontmatter) instructs cloning and building code — that grants the installer discretion to run arbitrary build steps from the repo.
!
Install Mechanism
The registry metadata stated 'no install spec', but the SKILL.md frontmatter contains an install entry that runs: git clone https://github.com/dhruvkelawala/ticktick-go /tmp/ttg-install && cd /tmp/ttg-install && make install && rm -rf /tmp/ttg-install. Cloning and make install will execute code from the remote repo on your machine. The repo is a public GitHub project (expected source), but the presence of an install script in SKILL.md (contradicting registry metadata) is an inconsistency and a potential execution risk if automated.
!
Credentials
The skill metadata lists no required environment variables or config paths, yet instructions require creating ~/.config/ttg/config.json containing TickTick client_id and client_secret. Those are sensitive credentials (client secret) and should be declared by the skill. The absence of declared credential requirements is disproportionate and should be corrected.
Persistence & Privilege
Privilege flags are normal: always=false, user-invocable=true, and model invocation allowed. The skill does not request permanent presence or elevated platform privileges.
What to consider before installing
This skill appears to be a legitimate wrapper around the public ticktick-go CLI, but there are two red flags to consider before installing or running any automated install: (1) SKILL.md includes a git clone && make install script (which will execute code from the remote repo on your machine) even though the registry metadata lists no install spec — verify and prefer to install ttg yourself manually after inspecting the repo and Makefile; (2) the skill asks you to create ~/.config/ttg/config.json with client_id and client_secret but the skill metadata does not declare these credentials or config paths — treat those values as sensitive, keep them local, and don't paste them into any remote UI you don't trust. Actionable steps: review the GitHub repository and Makefile for the install steps you would run; manually run ttg auth/login in your browser (instead of an automated install) to obtain tokens; only install or grant credentials if you trust the upstream repo and the skill author, and ask the publisher to correct the metadata so required credentials/config paths are declared explicitly.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsttg
checklistsvk979dknjas780er5np0vp2s2rd82kd2kclivk979dknjas780er5np0vp2s2rd82kd2kgovk979dknjas780er5np0vp2s2rd82kd2klatestvk979dknjas780er5np0vp2s2rd82kd2kproductivityvk979dknjas780er5np0vp2s2rd82kd2kremindersvk979dknjas780er5np0vp2s2rd82kd2ktasksvk979dknjas780er5np0vp2s2rd82kd2kticktickvk979dknjas780er5np0vp2s2rd82kd2k
345downloads
0stars
3versions
Updated 8h ago
v1.1.1
MIT-0

TickTick CLI Skill (ttg)

A feature-rich terminal interface for TickTick via the ticktick-go CLI.

Prerequisites

Install ttg:

git clone https://github.com/dhruvkelawala/ticktick-go
cd ticktick-go && make install

Create ~/.config/ttg/config.json with your TickTick API credentials (get them at developer.ticktick.com):

{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "timezone": "Europe/London"
}

Authenticate:

ttg auth login      # opens browser OAuth2 flow
ttg auth status     # confirm you're logged in

Task Commands

# List
ttg task list                              # Inbox (default)
ttg task list --all                        # Every task across all projects
ttg task list --project "Work"             # By project name
ttg task list --due today                  # Due today
ttg task list --due overdue                # Overdue tasks
ttg task list --priority high              # By priority
ttg task list --tag "urgent"               # By tag
ttg task list --completed                  # Show completed tasks
ttg task list --json                       # JSON output for scripting

# Add
ttg task add "Buy milk"
ttg task add "Review PR" --project "Work" --priority high --due "tomorrow 9am"
ttg task add "Call dentist" --today --high --remind "1h,on-time"
ttg task add "Weekly sync" --due "next friday" --repeat weekly
ttg task add "Quick note" -n "Don't forget the attachment" --tag "work,followup"

# Quick-add shorthands
ttg task add "Standup" --today --med
ttg task add "Submit report" --tomorrow --high
ttg task add "Urgent fix" --tmrw --remind "15m"

# Manage
ttg task get <id>                          # Full details
ttg task done <id>                         # Mark complete
ttg task delete <id>                       # Delete

# Edit
ttg task edit <id> --title "Updated title" --priority medium --due "next monday"
ttg task edit <id> --remind "1h,15m" --repeat monthly
ttg task edit <id> --tag "work,important" --start "tomorrow 9am"
ttg task edit <id> --kind checklist        # Convert to checklist

# Search
ttg task search "deploy"                   # Search tasks by title

Checklists & Subtasks

# Create a checklist task with initial items
ttg task add "Pack for trip" --checklist --items "Passport,Charger,Clothes"

# Manage checklist items
ttg task items <task-id>                   # List all items
ttg task item-add <task-id> "Toothbrush"   # Add an item
ttg task item-done <task-id> <item-id>     # Complete an item
ttg task item-delete <task-id> <item-id>   # Delete an item

Checklist tasks show a visual progress bar (0–100%) in list and detail views:

☑️ Pack for trip [60%]
│ Progress: [██████░░░░] 60%

Reminders

Add one or more reminders with --remind (comma-separated):

ShorthandMeaning
on-timeAt the due time
5m, 15m, 30mMinutes before
1h1 hour before
1d1 day before
ttg task add "Meeting" --due "3pm" --remind "15m,on-time"
ttg task edit <id> --remind "1h,30m"

Recurring Tasks

ttg task add "Daily standup" --due "9am" --repeat daily
ttg task add "Monthly review" --due "1st" --repeat monthly
ttg task add "Custom recurrence" --repeat "RRULE:FREQ=WEEKLY;BYDAY=MO,WE,FR"

Patterns: daily · weekly · monthly · yearly · custom RRULE

Project Commands

ttg project list                           # All projects with task counts
ttg project get <id>                       # Project details

Tag Commands

ttg tag list                               # List all tags used across tasks
ttg task list --tag "work"                 # Filter tasks by tag
ttg task add "New task" --tag "urgent,work" # Add with tags

Due Date Formats

InputResult
today, tomorrowMidnight of that day
next mondayFollowing Monday
3pm, tomorrow 3pmSpecific time
in 2 days, in 3 hoursRelative offset
2026-03-20ISO date
2026-03-20T15:00:00ISO datetime

Priority Values

none (default) · low · medium · high

Shorthand flags: --high, --med/--medium, --low

JSON / Scripting

Every list command accepts --json / -j:

# Get all high-priority tasks as JSON
ttg task list --priority high --json

# Pipe into jq
ttg task list --all --json | jq '.[] | select(.dueDate != null) | .title'

# Export project task counts
ttg project list --json | jq '.[] | {name, taskCount}'

Common Patterns

# Morning review — what's due today?
ttg task list --due today

# Quick capture while in flow
ttg task add "Follow up with Alex" --due "tomorrow 10am" --med --remind "1h"

# Create a shopping checklist
ttg task add "Groceries" --checklist --items "Eggs,Bread,Milk" --today

# End-of-day — mark things done
ttg task done <id>

# Weekly planning — see everything
ttg task list --all

# Find that task you can't remember
ttg task search "deploy"

Comments

Loading comments...