Tiny Talking Todos
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: ttt Version: 0.1.2 The skill bundle is benign. It primarily consists of documentation (`SKILL.md`) describing the usage of the `ttt` command-line interface for managing todo lists. There is no evidence of intentional harmful behavior such as data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. While the `ttt auth export` command is mentioned as a CLI feature that exposes credentials as environment variables, the skill does not instruct the agent to execute this command or subsequently exfiltrate the exposed credentials. The instructions are purely informational for using the `ttt` CLI.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If allowed to act without review, an agent could change or delete synced todo data.
The skill documents commands that can delete lists even when they contain todos and can update multiple todo items at once. This is aligned with todo management, but it is mutating authority.
ttt list delete "Old List" --force ... ttt todo batch-update --items
Require explicit confirmation for delete, force-delete, and batch-update actions, and use the documented undo/history commands if a mistake is made.
Commands run through the authenticated CLI can act on the user's synced todo account; exported credentials could be reused by scripts or exposed in the environment.
The skill requires authentication to the user's TinyTalkingTodos account and includes an option to export credentials for scripts. This is expected for the service integration but is still account-level access.
Before using the CLI, the user must be authenticated: ... ttt auth login ... ttt auth export
Authenticate only with the intended account, avoid credential export unless needed, and log out on shared machines.
Installing the external CLI gives that package execution ability on the local machine when installed or run.
The skill depends on installing an external npm package globally rather than bundling reviewed code. This is a normal setup pattern for a CLI skill, but users should trust the package source.
npm install -g @ojschwa/ttt-cli
Install from the expected npm package and publisher, and keep the CLI updated from a trusted source.
A background process and network connection may remain active briefly after commands are used.
The skill discloses background daemon behavior and a persistent connection. It is bounded by an inactivity shutdown and is purpose-aligned for performance.
The daemon keeps a persistent WebSocket connection ... auto-starts on first command if not running ... auto-shuts down after 30 minutes of inactivity.
Use `ttt daemon status` and `ttt daemon stop` if you do not want the daemon to keep running.