Todoist CLI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:20 AM UTC
• Version: 1.0.5

Overview

This Todoist skill is purpose-aligned but needs Review because it gives an agent broad read/write/delete control over a Todoist account with loose activation cues and limited safety guidance.

Install only if you want your agent to manage your Todoist account directly. Treat the Todoist token as a secret, prefer a protected environment variable, avoid pasting it into shared logs or chats, and review destructive requests such as delete or archive before allowing the agent to run them. Consider pinning and reviewing the Todoist CLI version before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24
Additional Location: README.md:20
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:24:

bash

npm install -g @doist/todoist-cli

README.md:20:

bash

npm install -g @doist/todoist-cli

Technical Analysis

The documented installation command globally installs @doist/todoist-cli without specifying an exact reviewed version or verifying package integrity. Consequently, npm resolves the package version available under the applicable default distribution tag at installation time.

This makes the installed artifact mutable relative to the audited skill. If the upstream package, maintainer account, publishing credentials, npm registry path, or a future release is compromised, users following these instructions could install code that was not part of this audit. npm packages can also execute lifecycle scripts during installation, allowing a compromised release to run code with the privileges of the user performing the installation.

Although the dependency is represented as the official Todoist CLI and no evidence establishes that its current releases are malicious, the unpinned installation process creates a supply-chain exposure.

Attack Path

1. An attacker compromises the upstream npm package, its maintainer or publishing credentials, or a future release process.
2. The attacker publishes a malicious release under @doist/todoist-cli or alters the release selected by the package's default distribution tag.
3. A user follows the project documentation and runs npm install -g @doist/todoist-cli.
4. npm retrieves the attacker-controlled, unreviewed release.
5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
6. The installed global command can continue executing attacker-controlled behavior whenever the agent or user invokes td.

Impact Assessment

Succe ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed release:

   bash

   npm install -g @doist/todoist-cli@<reviewed-exact-version>
   

2. Review the selected package version, including its lifecycle scripts and transitive dependencies, before recommending it.

3. Document the expected npm registry and provide an integrity-verification mechanism, such as a trusted checksum or provenance instructions.

4. Avoid installation with elevated privileges. Prefer a user-scoped installation or another isolated execution environment.

5. Establish a controlled dependency-update process in which version changes are explicitly reviewed and tested before documentation is updated.

6. Keep the documented version synchronized across SKILL.md and README.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README instructs users to authenticate with a raw Todoist API token and even shows passing it directly on the command line, but it provides no warning about token sensitivity, shell history exposure, or the fact that the token grants API-backed access to the user's Todoist account. In an agent skill context, this is more dangerous because users may follow setup steps verbatim and expose long-lived credentials to logs, process listings, transcripts, or shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown advertises capabilities such as completing, updating, deleting, archiving, and moving tasks/projects, but it does not include any user warning about changes to persistent Todoist data. For a skill that grants an AI 'full control' over a task system, users should be explicitly informed that the agent may modify or remove their tasks and projects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description includes broad activation cues such as 'tasks, to-dos, reminders, productivity,' which are common in ordinary conversation and can cause the skill to be invoked when the user did not explicitly intend Todoist access. Because this skill can read and mutate a user's task data, over-broad routing increases the chance of unintended data exposure or accidental task modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes destructive commands like task and project deletion without prominent warnings, confirmation guidance, or safer alternatives. In an agent-executed context, this can normalize irreversible operations and increase the likelihood that an LLM or user triggers data loss without understanding the consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.