Todoist Natural Language

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 AM UTC
• Version: 1.0.8

Overview

This Todoist skill is mostly coherent, but it needs review because it can change real account data and its install/invocation guidance is broader than necessary.

Install only with the user-scoped path, not the sudo global README commands. Use this skill only if you are comfortable giving it a Todoist API token and letting OpenClaw make live changes to your Todoist account; confirm destructive or ambiguous requests carefully, and set TZ explicitly if date filtering matters.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:34

Finding

Installation Documentation Unnecessarily Requires Root Privileges

Content

View full analysis

Vulnerability Details

File Location: README.md:34-39
Vulnerability Type: Least-privilege violation during installation
Risk Level: Medium

Complete Code Snippet:

bash

# Copy to OpenClaw skills directory
sudo cp todoist.skill /usr/lib/node_modules/openclaw/skills/

# Or unzip manually
sudo unzip todoist.skill -d /usr/lib/node_modules/openclaw/skills/

Technical Analysis

The documented installation process instructs users to copy or extract an externally downloaded .skill archive with root privileges into a global OpenClaw directory. This exceeds the minimum privileges needed for the Skill because skill.json separately documents a supported user-level destination under ~/.openclaw/skills/todoist/.

The sudo unzip variant is particularly risky because every archive entry is processed by a root-privileged extraction operation. If a release archive is compromised, substituted, or malformed, its contents could be written into a globally trusted Skill location with elevated privileges. The audited repository does not contain evidence of such a malicious payload; the vulnerability is the unnecessary privileged installation workflow and its increased consequences.

Attack Path

1. An attacker compromises, replaces, or distributes a modified .skill release archive.
2. A user downloads that archive and follows the README installation instructions.
3. The user executes sudo cp or sudo unzip, granting the installation operation root privileges.
4. Attacker-controlled files are placed in a root-owned, globally trusted OpenClaw Skill directory.
5. The user restarts OpenClaw as instructed.
6. OpenClaw may load the substituted Skill content, allowing its behavior to affect all users or processes relying on that global installation.

Impact Assessment

Successful exploitation could install attacker-controlled Skill files into a global, root-owned OpenClaw directory. The resulting ...[truncated 362 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the privileged installation instructions with the supported user-scoped installation path:

  bash

  mkdir -p ~/.openclaw/skills/todoist
  unzip todoist.skill -d ~/.openclaw/skills/todoist
  

• Make user-level installation the default and remove sudo from the recommended workflow.

• If global installation is genuinely required, extract the archive as an unprivileged user into a temporary directory first, inspect its file list, reject absolute paths and traversal entries, and then copy only validated files using narrowly scoped elevation.

• Publish cryptographic checksums or signed release artifacts and instruct users to verify them before installation.

• Pin installation instructions to a specific release version rather than an unqualified “latest” artifact.

• Reconcile README.md with skill.json so both consistently recommend ~/.openclaw/skills/todoist/.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The documented DELETE /tasks/{task_id} capability enables irreversible state-changing actions and could be abused if the skill maps ambiguous natural-language requests directly to deletion without robust confirmation and target validation. In a conversational task-management context, parameter confusion, prompt injection through task names, or mistaken entity resolution could cause unintended deletion of user data.

Content

Scanner excerpt · references/api.md (reported line 69)May include surrounding context.

Delete Task

text

DELETE /tasks/{task_id}

Projects

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented DELETE /projects/{project_id} operation is especially risky because deleting a project can remove or orphan a large set of user tasks and organization structure. In a natural-language skill, weak intent disambiguation or untrusted content influencing parameter selection could turn a benign request into broad destructive impact.

Content

Scanner excerpt · references/api.md (reported line 103)May include surrounding context.

Delete Project

text

DELETE /projects/{project_id}

Sections

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

2. Install to OpenClaw:

   bash

   # Copy to OpenClaw skills directory
   sudo cp todoist.skill /usr/lib/node_modules/openclaw/skills/
   
   # Or unzip manually
   sudo unzip todoist.skill -d /usr/lib/node_modules/openclaw/skills/
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

2. Install to OpenClaw:

   bash

   # Copy to OpenClaw skills directory
   sudo cp todoist.skill /usr/lib/node_modules/openclaw/skills/
   
   # Or unzip manually
   sudo unzip todoist.skill -d /usr/lib/node_modules/openclaw/skills/
   

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires environment access for a sensitive Todoist API key and performs network operations, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens containment and reviewability because the runtime may grant broader capabilities than users or platform policy expect, increasing the chance of unintended secret access or network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is broad enough to trigger on generic task, due date, or project-management language, not just explicit Todoist intent. That can cause over-invocation of a networked skill with credential access, leading to unintended external data access or modifications to a user's Todoist account when the user did not specifically intend to use this integration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

**Add tasks:**
- "Add 'buy milk' to my todo list"
- "Create a task to call the dentist tomorrow"
- "I need to review the Q4 report by Friday"
- "Add 'weekly standup' due every Monday"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents irreversible or state-changing operations such as deleting tasks and projects, completing tasks, and removing shared labels, but it provides no warning about potential data loss or the need for user confirmation. For markdown files, the skill description should warn about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md

from urllib.error import HTTPError, URLError
from urllib.parse import urlencode

API_BASE = "https://api.todoist.com/api/v1"

def get_auth_headers():
    """Get authorization headers with API token."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 197)May include surrounding context.

md

from urllib.error import HTTPError, URLError
from urllib.parse import urlencode

API_BASE = "https://api.todoist.com/api/v1"

def get_auth_headers():
    """Get authorization headers with API token."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/todoist.py (reported line 16)May include surrounding context.

python

from urllib.error import HTTPError, URLError
from urllib.parse import urlencode

API_BASE = "https://api.todoist.com/api/v1"

def get_auth_headers():
    """Get authorization headers with API token."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/todoist.py (reported line 201)May include surrounding context.

python

from urllib.error import HTTPError, URLError
from urllib.parse import urlencode

API_BASE = "https://api.todoist.com/api/v1"

def get_auth_headers():
    """Get authorization headers with API token."""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The comment and fallback logic explicitly default task-date handling to "US/Central" / "America/Chicago" when filtering for today. This imposes a specific locale/timezone behavior that can change results for users in other regions, and the file does not offer a user-facing opt-in or choice beyond an environment-variable workaround.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.json (reported line 16)May include surrounding context.

json

"optional_env": ["TZ"],
  "install": {
    "type": "manual",
    "note": "Copy to ~/.openclaw/skills/todoist/ — no sudo required for user install"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown usage section shows natural-language and CLI commands that create tasks and complete tasks in the user's real Todoist account. While the feature is clearly intended, the README does not include any user-facing caution that these commands perform persistent remote changes, unlike the safer read-only listing examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.