Security audit

todo.txt skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent todo.txt task-management skill, but it needs review because it can automatically run an installer that downloads code, builds it, uses sudo, and writes local configuration without an explicit consent step.

Install only if you are comfortable with an agent managing your local todo.txt files and installing todo.sh. Before first use, install todo.sh yourself or require the agent to ask before running scripts, Homebrew, git clone, make, sudo, archive, delete, or force-mode commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: These instructions tell the agent to automatically execute an installer if todo.sh is missing, despite the skill being scoped as a todo manager. Silent fallback to installation causes unanticipated shell execution and system modification without informed consent, increasing the risk of supply-chain abuse or accidental environment changes.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The manual installation path includes cloning a repository, compiling code, running sudo make install, and copying configuration into the user's home directory. For a todo-management skill, these are context-inappropriate privileged operations that materially increase risk if invoked in an automated agent setting.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: The Linux path clones code directly from a remote GitHub repository and immediately builds and installs it with sudo, creating a supply-chain and privilege-escalation risk. If the upstream repository, transport, or build process is compromised, arbitrary code could execute as the installing user and then with elevated privileges.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The README explicitly encourages broad natural-language triggering such as 'just describe what you need and let your agent pick the skill,' which can cause the skill to activate on ambiguous user input. Because this skill performs state-changing CLI operations on a persistent task file and may also install software, unintended activation could lead to unauthorized task modification or unexpected command execution paths.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs automatic shell execution of an installer with no user-facing warning that software will be installed and local configuration changed. This is dangerous because users invoking a simple todo action would not reasonably expect package installation or execution of bundled scripts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The manual fallback includes system-modifying and privileged commands such as package installation, git clone, build steps, sudo install, and copying config files, but provides no safety warning or consent gate. In an agent context, this can normalize execution of risky commands that affect system integrity and provenance.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guidance encourages using the -f flag to skip confirmation prompts and includes destructive operations like delete and archive. In an automated setting, suppressing confirmations increases the chance of accidental or irreversible task modifications without giving the user a chance to review the target action.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The Linux branch performs sudo make install and writes configuration under the user's home directory without an explicit warning or confirmation about these changes. This increases the risk of unexpected system and persistence changes, especially in automated or agent-driven contexts where users may not realize privileged actions will occur.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.