ClawHub
Back to skill

Security audit

automate-todo

Security checks for vulnerabilities and agentic risk

Overview

This TODO automation skill is not malicious, but it needs review because it can make broad repository changes and includes a workspace-wide revert command that could discard uncommitted work.

Review this skill before installing. It may be useful for repositories that already use TODO.md-driven release work, but users should require explicit approval before it creates roadmap entries, changes manifests or changelogs, or performs any rollback. The git restore . fallback should be removed or replaced with a targeted, user-confirmed revert.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill expands from executing existing TODO items into reading the codebase, inventing or selecting new TODO items, prioritizing them, and writing a roadmap. That materially broadens authority beyond the stated automation scope and can cause unauthorized modifications or agent-driven task creation that the user never explicitly requested.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation description is overly broad and overlaps with generic requests like updating documentation, maintaining a roadmap, or applying version updates. This can cause the skill to auto-activate in situations where the user did not intend repository-wide TODO automation, increasing the chance of surprising edits across docs, changelogs, manifests, and roadmap files.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs running `git restore .`, a destructive workspace-wide revert, without requiring explicit user approval or warning about data loss. In an agent context this can silently discard uncommitted user changes unrelated to the TODO task, making the blast radius much larger than the intended operation.

Static analysis

No suspicious patterns detected.