Cn Todo Today

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.2.6

Overview

This is a small local Chinese todo-list skill whose file access and delete behavior match its stated purpose, with minor data-retention and local file-hardening caveats.

Install only if you are comfortable with todo text being stored locally in ~/.cn_todo_today.json. Avoid putting secrets in todo items, and manually back up the file if retention matters because delete removes items from the active todo list and the documentation mentions cleanup behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/cn_todo_today.py:24

Finding

Todo Data File Is Created Without Restrictive Permissions or Symlink Protection

Content

View full analysis

Vulnerability Details

File Location: scripts/cn_todo_today.py, lines 24-26
Vulnerability Type: Insecure local file creation and symbolic-link following
Risk Level: Low

python

with open(TODO_FILE, 'w', encoding='utf-8') as f:
    json.dump(data, f, ensure_ascii=False, indent=2)

Technical Analysis

The application stores todo data in the fixed path ~/.cn_todo_today.json using the standard open() function without explicitly applying restrictive permissions. The permissions assigned to a newly created file therefore depend on the process umask. Under a commonly used umask of 022, the file can be created with mode 0644, allowing other local users to read its contents when directory permissions permit traversal.

The operation also follows symbolic links. If an attacker can manipulate the target path before the application saves data, the attacker can replace ~/.cn_todo_today.json with a symbolic link to another file writable by the invoking user. A subsequent save will truncate that target and replace its contents with JSON data.

The implementation does not use exclusive creation, a no-follow option, atomic replacement, or validation that the destination is a regular file owned by the current user.

Attack Path

Information disclosure path:

1. The user runs an operation that invokes save_todos().
2. The application creates ~/.cn_todo_today.json with permissions derived from the current umask.
3. If those permissions allow local reads and the home directory is traversable, another local user reads the file.
4. Todo descriptions and their creation or completion timestamps are disclosed.

Symbolic-link overwrite path:

1. An attacker with the ability to manipulate ~/.cn_todo_today.json removes or renames the existing file.
2. The attacker creates a symbolic link at that path pointing to another file writable by the victim user.
3. The victim invokes an operation that sa ...[truncated 930 chars]

Remediation

View remediation

Remediation Suggestions

• Create the data file with owner-only permissions (0600) rather than relying on the process umask.
• Write updates to a securely created temporary file in the same directory and atomically replace the destination with os.replace().
• Create the temporary file using tempfile.mkstemp() or tempfile.NamedTemporaryFile() with restrictive permissions.
• Reject symbolic links by using os.open() with O_NOFOLLOW where supported and verify with os.fstat() that the opened object is a regular file.
• Verify that an existing destination is owned by the current user before replacing it.
• Flush buffered data and call os.fsync() before atomic replacement when durability is required.
• Apply os.chmod(TODO_FILE, 0o600) to securely migrate an existing regular data file, after validating its ownership and type.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The usage examples include a delete operation, and the notes state that completed todos are automatically cleaned daily. While these behaviors are documented functionally, the markdown does not clearly warn users that items may be permanently removed from the local JSON store, which can affect user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents its purpose and all user-facing prompts in Chinese, indicating a fixed language choice. The file does not offer any user opt-in, locale selection, or documented region-specific justification, which fits the language/locale policy-violation category.

Content

No source excerpt is available for this finding.