ClawHub
Back to skill

Security audit

Todo Management 1.1.2

Security checks across malware telemetry and agentic risk

Overview

This is a local SQLite todo manager with ordinary add, edit, list, and delete behavior, plus an unused packaging oddity that users should notice.

Install this only if you want a local todo.db created in each workspace. Avoid storing secrets in todos, and be careful with clear, remove, and --delete-entries commands because they delete local todo data. Do not run npm or pnpm install in the skill directory unless the publisher explains why those unused package files are present.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
87% confidence
Finding
The markdown describes `group remove "Work" --delete-entries`, which can permanently delete todo entries, but it does not include any explicit warning or caution about irreversible data loss. For markdown files, destructive behaviors affecting user data should be accompanied by a warning.

Unpinned Dependencies

Low
Category
Supply Chain
Content
{
	"dependencies": {
		"package-lock.json": "^1.0.0"
	}
}
Confidence
40% confidence
Finding
"package-lock.json": "^1.0.0"

VirusTotal

46/46 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.