Openclaw with Remember The Milk

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:14 AM UTC
• Version: 1.0.9

Overview

This RTM task skill appears purpose-aligned, but it should go to Review because it stores and handles account credentials/tokens and can modify or delete remote tasks without strong safeguards.

Install only if you trust this skill with your Remember The Milk account. Prefer environment variables or a credential manager over typing secrets into rtm config, restrict access to any ~/.rtm-*.json files, avoid using it from automated agents that might delete tasks without review, and consider rotating credentials if full RTM request URLs or config commands have been logged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:103

Finding

RTM API credentials exposed through command-line arguments

Content

View full analysis

'); } fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify({ API_KEY: newApiKey, SHARED_SECRET: newSecret }, null, 2), { mode: 0o600 }); ``` The corresponding documented command is: ```bash rtm config ``` ### Technical Analysis The recommended configuration mechanism accepts both the RTM API key and shared secret as ordinary command-line arguments. Although the destination file is created with restrictive `0600` permissions, those permissions only protect the resulting file. They do not protect credentials while they are present in the command line. Depending on the host environment, command arguments may be exposed through: - Interactive shell history. - Terminal session recording. - Process inspection while the command is running. - Endpoint monitoring and command-auditing software. - CI/CD logs or automation diagnostics. - Copy-and-paste records and support transcripts. The implementation does not redact, prompt securely for, or otherwise prevent retention of the shared secret. This is especially relevant because the documentation describes this command as the recommended setup method. ### Attack Path 1. A user follows the documentation and runs `rtm config` with the API key and shared secret directly in the command. 2. The shell, terminal recorder, process monitor, or command-auditing system records the complete invocation. 3. An attacker or lower-privileged operator with access to those records retrieves the API key and sh ...[truncated 1073 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: rtm-client.js:23

Finding

Authentication tokens and private task data transmitted in URL query strings

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill presents itself as a simple RTM integration with no declared permissions, while the documented behavior includes outbound API access, local token storage, and destructive operations such as modifying and deleting tasks. This mismatch can mislead users and security systems about the real authority of the skill, increasing the chance of unauthorized or unexpected account actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill instructs users to store an API key and shared secret in a predictable local file under the home directory, and labels this as safe without describing file permission requirements or OS credential-store alternatives. If that file is readable by other local processes, users, backups, or malware, the credentials could be stolen and used to access or manipulate the user's RTM account.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

rtm config

text

This saves the credentials safely to `~/.rtm-credentials.json` ensuring they persist across terminal restarts.

### Method B: Using a `.env` file

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 5)May include surrounding context.

js

const path = require('path');
const os = require('os');

// Load .env manually to avoid third-party dependencies
const envPath = path.join(__dirname, '.env');
if (fs.existsSync(envPath)) {
    const envFile = fs.readFileSync(envPath, 'utf8');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 6)May include surrounding context.

js

const os = require('os');

// Load .env manually to avoid third-party dependencies
const envPath = path.join(__dirname, '.env');
if (fs.existsSync(envPath)) {
    const envFile = fs.readFileSync(envPath, 'utf8');
    envFile.split(/\r?\n/).forEach(line => {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 24)May include surrounding context.

js

const RTMClient = require('./rtm-client');

const TOKEN_FILE = path.join(os.homedir(), '.rtm-token.json');
const CREDENTIALS_FILE = path.join(os.homedir(), '.rtm-credentials.json');
const ID_CACHE_FILE = path.join(os.homedir(), '.rtm-id-cache.json');

module.exports = {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation describes networked functionality and credential handling, but the manifest does not declare any tool scope or allowed tools. In an agent environment, missing permission declarations can cause users or orchestrators to underestimate the skill's ability to access environment data and make outbound requests, weakening trust and review controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documentation recommends placing long-lived API credentials in a local .env file inside the skill folder, which creates persistent secret exposure risk through accidental commits, workspace sharing, backups, or other local tooling. In agent environments, project-directory files are often more broadly accessible than users expect, making this context more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Method B: Using a .env file

Create a file named .env in this skill's folder (you can use .env.example as a template) and add your keys:

env

RTM_API_KEY="your-api-key"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rtm-client.js (reported line 7)May include surrounding context.

js

constructor(apiKey, sharedSecret) {
        this.apiKey = apiKey;
        this.sharedSecret = sharedSecret;
        this.endpoint = 'https://api.rememberthemilk.com/services/rest/';
        this.authEndpoint = 'https://www.rememberthemilk.com/services/auth/';
        this.token = null; // Will be set after auth
    }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code sends request parameters, including the API key, auth token, and user task-related data, to a remote Remember The Milk endpoint via HTTP requests. There is no confirmation prompt, logging, comment, or docstring in this file disclosing that user data and credentials are transmitted off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The deleteTask method performs a destructive remote deletion of a task, but this file contains no confirmation, warning, or explanatory comment indicating that the action is irreversible or affects user data. For code files, destructive operations should have some form of user disclosure unless the warning is documented elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation exposes a delete command without clearly warning that it is destructive or may be irreversible. In an LLM-agent or CLI context, insufficient warning increases the risk of accidental data loss, especially when commands may be generated or executed quickly.

Content

No source excerpt is available for this finding.