Security audit

Neomano TODO

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local SQLite-based todo manager with disclosed persistence and reminder metadata; its risks are mainly normal user-control considerations for reminders and deletion.

Install this if you want a local persistent todo database. Before using reminders, confirm the delivery channel and target because reminder details may be sent through external messaging via OpenClaw cron. Treat the delete command as permanent and prefer forgotten or expired status if you want to retain history.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents use of environment variables and a local SQLite-backed helper script, but it does not declare any explicit tool scope such as allowed tools or permissions. That makes the skill's runtime expectations under-specified and can lead an agent to access environment configuration or execute local code without clear containment or review boundaries.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description is broad enough that the skill may be invoked for many generic task-management requests, including cases where the user did not intend persistent storage or reminder scheduling. Over-broad triggering can cause unnecessary access to local task data or unintended writes, which is a security and privacy boundary issue for an agentic system.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes reminder scheduling and default external delivery targets/channels, including examples like WhatsApp and phone numbers, without an explicit warning or consent step before sending task data externally. This creates a real risk of sensitive task content, timestamps, or identifiers being transmitted to third-party messaging channels without the user's informed approval.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest frames this skill as a task manager with explicit lifecycle statuses, including expire/forget operations, but does not mention hard deletion from the database. The `delete` command removes task records entirely, which goes beyond the described status-based lifecycle model and loses reminder/history metadata instead of marking a task forgotten or expired.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This code file performs a destructive operation by deleting a task record from the SQLite database. Although the CLI subcommand is named 'delete', there is no confirmation prompt or explicit warning in nearby user-facing output about the irreversible data removal.

Static analysis

No suspicious patterns detected.