todoist latest

Manage Todoist tasks. Use when the user mentions "todoist", "my tasks", "task list", "add a task", "complete task", or wants to interact with their Todoist account.

Security Scan

The skill's behavior (calling a Todoist CLI that will read/write the Todoist API and local cache) matches its description, but it omits any declaration or guidance about the credentials/config the CLI needs and uses a third‑party Homebrew tap — these mismatches merit caution.

Purpose & Capability

Name/description align with using the 'td' CLI to manage Todoist. However, the skill declares no credentials or config paths even though the described operations write to the Todoist API and read/write a local cache — a Todoist API token or local config is required in practice. The lack of declared credential requirements is inconsistent with the stated capability.

Instruction Scope

SKILL.md only instructs the agent to run the 'td' binary for various operations (list, add, done, sync, etc.). The instructions themselves do not ask the agent to read arbitrary user files or env vars, but they rely entirely on an external binary that will access the network and local cache/config (and therefore user credentials). The skill does not document where those credentials/config live or how they're provided.

Install Mechanism

The install spec uses a Homebrew formula from a third‑party tap (LuoAndOrder/tap/todoist-cli) which creates the 'td' binary. Using Homebrew is reasonable, but the tap is not the official Homebrew/core; that increases supply‑chain risk relative to an official package.

Credentials

requires.env is empty and no primary credential is declared, yet the skill's operations 'hit the API directly' and use a local cache. This implies the 'td' binary will rely on a Todoist API token or local config (credentials) that are not disclosed in the skill metadata. That omission prevents users from understanding what secrets or config the skill will access.

Persistence & Privilege

always is false and the skill does not request persistent agent-wide privileges. There's no indication it modifies other skills or system settings.

Scan Findings in Context

[no_regex_findings] expected: The scanner found no code to analyze because this is an instruction-only skill (SKILL.md). That absence is expected but means the security surface is the external 'td' binary and the brew tap rather than code embedded in the skill.

What to consider before installing

This skill is coherent (it delegates Todoist work to the 'td' CLI) but has two practical concerns: (1) it does not declare how the Todoist API token or local config are provided or where they are stored — the 'td' binary will need credentials and will read/write a local cache, so inspect how 'td' authenticates (env vars, ~/.config, etc.) before use; (2) the Homebrew formula comes from a third‑party tap (LuoAndOrder) rather than core Homebrew — review the tap/formula and the upstream repo for trustworthiness. Recommendations: (a) review the 'td' project's README to learn where it stores credentials and whether it uses plaintext tokens; (b) verify the Homebrew formula or build from source if you don’t trust the tap; (c) limit the Todoist API token's scope if possible and store it securely (use a dedicated token); (d) consider running the CLI in an isolated environment (container) until you confirm its behavior. If you want, I can fetch the repo/homepage and point out where the CLI stores config and how to inspect the Homebrew formula before installing.

Todoist Integration

Manage tasks via td CLI (todoist-rs).

Installation

brew install LuoAndOrder/tap/todoist-cli

Or install via Cargo: cargo install todoist-cli-rs

Sync Behavior

• Writes auto-sync: add, done, edit, delete hit the API directly
• Reads use cache: list, today, show read from local cache
• Sync when needed: Use --sync flag or td sync for fresh data

td sync              # Incremental sync (fast)
td sync --full       # Full rebuild if cache seems off

Common Operations

List Tasks

# Today's agenda (includes overdue)
td today --sync

# Today only (no overdue)
td today --no-overdue

# All tasks
td list --sync

# By project
td list -p "Inbox" --sync
td list -p "Work" --sync

# High priority
td list -f "p1 | p2" --sync

# By label
td list -l "urgent" --sync

# Complex filters
td list -f "today & p1" --sync
td list -f "(today | overdue) & !@waiting_on" --sync

Add Tasks

Quick add (natural language):

td quick "Buy milk tomorrow @errands #Personal"
td quick "Review PR tomorrow" --note "Check the auth changes carefully"

Structured add:

td add "Task content" \
  -p "Inbox" \
  -P 2 \
  -d "today" \
  -l "urgent"

# With description
td add "Prepare quarterly report" -P 1 -d "friday" \
  --description "Include sales metrics and customer feedback summary"

Options:

• -P, --priority - 1 (highest) to 4 (lowest, default)
• -p, --project - project name
• -d, --due - due date ("today", "tomorrow", "2026-01-30", "next monday")
• -l, --label - label (repeat for multiple)
• --description - task description/notes (shown below task title)
• --section - target section within project
• --parent - parent task ID (creates subtask)

Complete Tasks

td done <task-id>
td done <id1> <id2> <id3>              # Multiple at once
td done <id> --all-occurrences         # End recurring task permanently

Modify Tasks

td edit <task-id> -c "New content"
td edit <task-id> --description "Additional notes here"
td edit <task-id> -P 1
td edit <task-id> -d "tomorrow"
td edit <task-id> --add-label "urgent"
td edit <task-id> --remove-label "next"
td edit <task-id> --no-due             # Remove due date
td edit <task-id> --section "Next Actions"
td edit <task-id> -p "Work"            # Move to different project

Edit options:

• -c, --content - update task title
• --description - update task description/notes
• -P, --priority - change priority (1-4)
• -d, --due - change due date
• --no-due - remove due date
• -l, --label - replace all labels
• --add-label - add a label
• --remove-label - remove a label
• -p, --project - move to different project
• --section - move to section within project

Show Task Details

td show <task-id>
td show <task-id> --comments

Delete Tasks

td delete <task-id>

Reopen Completed Tasks

td reopen <task-id>

Project & Label Management

# Projects
td projects                            # List all
td projects add "New Project"
td projects show <id>

# Labels
td labels                              # List all
td labels add "urgent"

Filter Syntax

Use with -f/--filter:

• | for OR: today | overdue
• & for AND: @next & #Personal
• Parentheses: (today | overdue) & p1
• Negation: !@waiting_on
• Priority: p1, p2, p3, p4
• Dates: today, tomorrow, overdue, no date, 7 days

Workflow Tips

1. Morning review: td today --sync
2. Quick capture: td quick "thing to do"
3. Focus list: td list -f "@next" --sync
4. Waiting on: td list -f "@waiting_on" --sync
5. End of day: td today (cache is fine, already synced)