todoist latest

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:38 AM UTC
• Version: 1.0.1

Overview

This Todoist skill is coherent and not malicious, but it deserves Review because it can modify or delete a live Todoist account with broad triggers and relies on unpinned third-party CLI installation sources.

Install only if you trust the todoist-cli publisher and are comfortable giving the CLI access to your Todoist account. Use explicit Todoist wording when asking the agent to act, review proposed write/delete commands before they run, and consider installing a pinned reviewed CLI version rather than the unpinned Homebrew or Cargo commands shown.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party CLI Installation from Mutable Package Sources## Vulnerability Details **File Location**: `SKILL.md:5, 12-18` **Vulnerability Type**: Supply-chain exposure through unpinned third-party dependencies **Risk Level**: Medium The skill declares and recommends installation of the Todoist CLI from a personal Homebrew tap or the public Cargo registry without pinning an immutable version, commit, checksum, or cryptographic signature. ```yaml metadata: {"clawdbot":{"emoji":"✅","requires":{"bins":["td"]},"install":[{"id":"brew","kind":"brew","formula":"LuoAndOrder/tap/todoist-cli","bins":["td"],"label":"Install todoist-cli via Homebrew"}]}} ``` ```markdown ## Installation ```bash brew install LuoAndOrder/tap/todoist-cli ``` Or install via Cargo: `cargo install todoist-cli-rs` ``` ### Technical Analysis Both installation methods resolve mutable third-party package sources at installation time: - `brew install LuoAndOrder/tap/todoist-cli` trusts a formula maintained in a third-party personal tap. - `cargo install todoist-cli-rs` resolves the package version available from the Cargo registry unless a specific version is supplied. The reviewed skill does not constrain either source to a known-good release or immutable revision and does not require verification of a checksum or signature. Consequently, the code installed in the future may differ from the code that existed when this skill was audited. Cargo dependencies may also execute build scripts during compilation, while Homebrew formulae control package retrieval and installation behavior. There is no evidence in the reviewed file that the current packages are malicious. The vulnerability is the absence of dependency pinning and integrity verification, which creates a supply-chain attack opportunity. ### Attack Path 1. An attacker compromises the Homebrew tap, Cargo publisher account, upstream release infrastructure, or another relevant dependency distribution channel. 2. The attacker publishes a malicious pack ...[truncated 1437 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a specifically reviewed version rather than resolving the latest available release. 2. Where supported, pin the installation source to an immutable commit or content-addressed artifact. 3. Publish and verify cryptographic checksums or signatures for downloaded binaries before execution. 4. Prefer an official, organization-controlled distribution channel over a personal package tap. 5. For Cargo installations, use an exact reviewed version and assess the resolved dependency tree, including build scripts and transitive dependencies. 6. Document the expected publisher, repository, release version, artifact digest, and verification procedure in `SKILL.md`. 7. Perform installation with an unprivileged account and avoid `sudo` or administrator execution. 8. Re-audit pinned releases before updating the declared version or integrity digest.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description includes broad trigger phrases like "my tasks," "task list," and "add a task," which can cause the skill to activate in situations where the user did not explicitly intend Todoist account actions. Because this skill supports both read and write operations against a live Todoist account, unintended invocation can lead to privacy exposure or accidental task modification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents write operations that auto-sync to the remote Todoist API, including edit and delete, but does not warn that these actions immediately affect the user's real account. In an agent setting, lack of explicit caution and confirmation around destructive operations increases the chance of accidental or unauthorized account changes.

Static analysis

No suspicious patterns detected.