ClawHub
Back to skill

Security audit

TickTick CLI

Security checks across malware telemetry and agentic risk

Overview

This is a coherent TickTick command-line skill that can read and change TickTick tasks, with sensitive local OAuth storage that users should protect.

Install only if you are comfortable granting read/write access to your TickTick tasks and projects. Protect the plaintext config file, avoid syncing or exposing ~/.clawdbot/credentials/ticktick-cli/config.json, revoke the TickTick app if credentials leak, and require explicit approval before task mutations such as complete, abandon, batch-abandon, or project updates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill documents shell execution and outbound network use but does not declare corresponding permissions. That creates a trust and policy gap: an agent or reviewer may authorize or run the skill without understanding that it can invoke local commands and communicate with external services. In this context, the OAuth flow and API operations make those capabilities real rather than hypothetical.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill includes destructive 'abandon' and bulk 'batch-abandon' operations without a prominent warning, confirmation guidance, or recovery caveat. In an agent setting, that raises the risk of accidental mass modification or deletion-like state changes to user tasks, especially when IDs are supplied programmatically.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill persists the OAuth client ID and client secret to a local JSON file, and later also stores access and refresh tokens in the same file. Although file permissions are restricted to the current user, this is still sensitive secret material at rest and users are not warned that long-lived credentials will be stored locally; compromise of the local account, backups, or dotfile syncing could expose the TickTick account.

Session Persistence

Medium
Category
Rogue Agent
Content
### 1. Register a TickTick Developer App

1. Go to [TickTick Developer Center](https://developer.ticktick.com/manage)
2. Create a new application
3. Set the redirect URI to `http://localhost:8080`
4. Note your `Client ID` and `Client Secret`
Confidence
78% confidence
Finding
The skill instructs users to authenticate via OAuth and persist client credentials, access tokens, and refresh tokens in a local plaintext config file. Persistent tokens increase exposure if the host, home directory, backups, or logs are compromised, and the risk is heightened because the file contains both long-lived refresh material and the client secret.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"ticktick": "./scripts/ticktick.ts"
  },
  "dependencies": {
    "commander": "^12.0.0",
    "open": "^10.0.0"
  },
  "devDependencies": {
Confidence
94% confidence
Finding
The dependency uses a caret version range, which allows new minor/patch releases to be installed automatically. This increases supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review; in a CLI that handles OAuth2 flows, dependency trust matters even if this file itself contains no malicious logic.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "commander": "^12.0.0",
    "open": "^10.0.0"
  },
  "devDependencies": {
    "@types/bun": "^1.0.0"
Confidence
95% confidence
Finding
The open package is referenced with a caret range, so future compatible releases may be installed implicitly. Because this package may launch browser/system handlers during OAuth2 login, a malicious upstream update could affect a security-sensitive execution path and broaden the impact of a supply-chain compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/auth.ts:103