Tiny Talking Todos

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:55 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward guide for using a todo-list CLI, with disclosed mutations and deletion commands, but users should be careful with the global npm install and destructive operations.

Before installing, understand that this skill operates on your TinyTalkingTodos account and can create, update, batch-edit, and delete synced todo data. Use care with delete and force-delete commands, confirm the exact list or todo ID first, and consider pinning or reviewing the npm package before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g @ojschwa/ttt-cli

Technical Analysis

The installation instructions retrieve the current published version of @ojschwa/ttt-cli from the npm registry without specifying an exact version or verifying an integrity hash. The project contains no lockfile or vendored source that would establish which package contents were reviewed.

npm packages can execute lifecycle scripts during installation. Because the command also installs the package globally, package-controlled code may execute with the installing user's privileges and place executable files in a global binary location. The effective package contents can change after this skill has been reviewed, creating a supply-chain risk if the publisher account, package, registry delivery path, or a future release is compromised.

This finding does not establish that the named package is malicious. It identifies an unsafe, mutable dependency-installation process whose retrieved implementation is outside the audited project.

Attack Path

1. An attacker compromises the package publisher account, package release process, or another relevant npm supply-chain component.
2. The attacker publishes a malicious release under the existing package name.
3. A user follows the documented unversioned installation command.
4. npm resolves the mutable package reference to the malicious release.
5. Malicious package lifecycle scripts may execute during installation, or the globally installed ttt executable may execute malicious logic when subsequently invoked.
6. The code operates with the installing user's privileges and can access resources available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on t ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example:

   bash

   npm install -g @ojschwa/ttt-cli@X.Y.Z
   

2. Document and verify the expected package provenance and integrity digest before installation.
3. Prefer a project-local installation governed by a committed lockfile rather than a global installation.
4. Review the resolved package, transitive dependencies, and lifecycle scripts before recommending them.
5. Disable lifecycle scripts during installation with --ignore-scripts when they are not required. If scripts are required, document why and audit their contents.
6. Use npm provenance and signature verification controls where supported, and establish a controlled process for reviewing dependency upgrades.
7. Run the CLI with least privilege and avoid installing it from an elevated shell.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents list deletion, including a force-delete option, without warning that the action permanently removes user data. In an agent setting, concise command examples can be copied or executed directly, so omission of a safety warning increases the risk of accidental destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The todo deletion section shows direct removal commands without noting that the action deletes user data and may be irreversible outside undo/history limits. Because this skill is designed for task execution through a CLI, an agent could invoke these commands on behalf of a user without adequately surfacing the destructive consequence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.