ClawHub
Back to skill

Security audit

TickTick

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing TickTick tasks, but it under-discloses credential exposure risk and installs an unpinned global npm CLI.

Review before installing. Prefer the browser OAuth flow, avoid pasting API tokens into commands or chat transcripts, and consider installing a reviewed pinned CLI version in an isolated environment rather than using the unpinned global npm command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code:

bash
npm install -g @ticktick/ticktick-cli

Technical Analysis

The Skill instructs the agent to install the latest available version of @ticktick/ticktick-cli globally. No exact version, integrity hash, lockfile, provenance validation, or package verification procedure is specified.

Because the selected package version can change after the Skill has been audited, future executions may install code different from the version originally reviewed. npm packages may also execute lifecycle scripts during installation. Global installation expands the potential effect by placing executable files in a shared command location and running installation logic with the permissions of the invoking user. If the command is run with elevated permissions to resolve a global installation error, the resulting impact could increase significantly.

There is no evidence in the audited file that the named package is currently malicious. The vulnerability is the mutable and insufficiently verified dependency installation process.

Attack Path

  1. An attacker compromises the upstream npm package, a maintainer account, or its release process.
  2. The attacker publishes a malicious release under the same package name.
  3. An agent follows the Skill and runs the unpinned global installation command.
  4. npm resolves the command to the attacker-controlled release.
  5. Malicious lifecycle scripts or package code execute with the permissions of the user running npm.
  6. The globally installed executable can continue to run attacker-controlled behavior whenever subsequent TickTick commands are invoked.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's account, access files and credentials available to ...[truncated 422 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to an explicitly reviewed version, for example:
    bash
    npm install -g @ticktick/ticktick-cli@REVIEWED_VERSION
  • Verify the package name, publisher, provenance, and expected integrity before installation.
  • Document the reviewed version and update it only through a controlled dependency-review process.
  • Prefer a project-local or isolated installation over a global installation where operationally practical.
  • Do not recommend sudo or other privilege elevation to resolve npm permission errors.
  • Consider disabling lifecycle scripts during installation when compatible with the package, then explicitly perform only required setup steps.
  • Re-run package security and provenance checks before approving version upgrades.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:85
Finding

OAuth Access Token Passed as a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85-89
Vulnerability Type: Sensitive credential exposure through process arguments and command records
Risk Level: Medium

Vulnerable Code:

bash
### Alternative methods
   **API token:** Get your API token from **Settings > Account > API Keys**:
   ```bash
   ticktick auth token <token>   # set access token directly (for headless environments)
   ```

Technical Analysis

The documented headless authentication method places an OAuth access token directly in the command-line argument list. Bearer tokens supplied this way may be retained in shell history, terminal recordings, agent transcripts, command-audit logs, CI logs, or process-monitoring telemetry. Depending on the operating system and local permissions, command arguments may also be observable through process inspection while the command is running.

The Skill does not warn users about these disclosure channels, require output redaction, or provide a safer secret-input mechanism. Sending authentication information to TickTick is necessary for the declared functionality, but exposing the credential through command metadata exceeds the minimum disclosure necessary to authenticate.

Attack Path

  1. A user supplies a valid TickTick API token in place of the documented placeholder.
  2. The agent executes or displays the resulting command with the plaintext token in its argument list.
  3. The command is captured in shell history, an agent transcript, terminal logs, CI output, command auditing, or process telemetry.
  4. A local user, log reader, support operator, or other party with access to those records retrieves the token.
  5. The attacker reuses the bearer token against TickTick before it expires or is revoked.
  6. The attacker accesses or modifies TickTick resources permitted by the token.

Impact Assessment

A disclosed token may permit unauthorized access to the v ...[truncated 423 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer the documented OAuth PKCE browser flow rather than direct token entry.
  • If headless token authentication is necessary, use a CLI mechanism that reads the token through hidden interactive input, standard input, or a protected file descriptor rather than a command-line argument.
  • Store the token in an operating-system secret manager or another permission-restricted credential store.
  • Never print the token in agent responses, command summaries, diagnostics, or error messages.
  • Explicitly require redaction of token values from transcripts, terminal recordings, CI logs, and audit output.
  • Avoid placing tokens in persistent environment variables unless the environment is tightly controlled and the exposure implications are documented.
  • If command-line entry is unavoidable, warn the user about shell-history and process-list exposure, prevent history recording for that operation, minimize token lifetime and scope, and revoke the token immediately if disclosure is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documented command accepts an access token directly as a positional CLI argument, which is a classic credential-exposure pattern. In an agent setting, this is more dangerous because the token may be captured in tool-call logs, telemetry, audit trails, terminal history, or visible to other local users via process inspection.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Alternative methods

API token: Get your API token from Settings > Account > API Keys:

bash
ticktick auth token <token>   # set access token directly (for headless environments)
  1. Confirm login status:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs agents to use direct API-token authentication in a command line argument without any warning about sensitive credential handling. Supplying tokens on the command line can expose them through shell history, process listings, logs, or agent transcripts, making credential disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.