TODO Tracker

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9d3ee47bc20226893e8c8f755f37a3a43b8a8ae48513d5055bfe1c8c66c3be48
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential Regular Expression Denial of Service (ReDoS) vulnerability in `scripts/todo.sh`. User-provided patterns for 'mark done' and 'remove item' commands are directly used in `grep` and `sed` regex operations without sufficient sanitization, which could allow a malicious or overly complex regex pattern to consume excessive CPU resources and lead to a denial of service. While the skill's core functionality is benign and involves local file operations, this specific implementation detail introduces a notable risk.