ClawHub
Back to skill

Security audit

Todoist

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Todoist helper that uses the public td CLI to view and manage tasks, with ordinary setup and account-access risks.

Install this only if you want your agent to use Todoist through the td CLI. Review or pin the upstream Todoist CLI before running the setup commands if you are cautious about supply-chain risk, and be aware that generic task or agenda requests may cause the agent to consult or modify your Todoist data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The manifest description contains very broad trigger phrases like todos/tasks/agenda/checklist and common operations such as list, add, update, complete, and delete. This can cause the skill to activate in many loosely related conversations, increasing the chance of unintended access to Todoist data or accidental task modification when the user did not explicitly intend to use this skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.