Remember The Milk

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:34 PM UTC
• Version: 1.1.0

Overview

This skill appears to do what it claims: manage Remember The Milk tasks, with sensitive account access and delete capability disclosed.

Install this only if you want an agent to manage your Remember The Milk account. Keep RTM_API_KEY and RTM_SHARED_SECRET in skill configuration, protect or remove ~/.rtm_token when not needed, and review delete or note-deletion actions before running them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly requires environment variables, reads and writes a persistent token file, and makes outbound network requests, yet no explicit permissions are declared. That mismatch weakens security review and enforcement because the platform cannot accurately constrain or inform users about the skill's actual capabilities. In this context, the undeclared access is especially relevant because the token grants ongoing account access and the skill performs destructive actions like delete.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- **Env vars:** `RTM_API_KEY` and `RTM_SHARED_SECRET` are required at runtime. Configure via OpenClaw skill env, not hardcoded.
- **Auth token:** Stored as plain text at `~/.rtm_token` after interactive auth. This file grants full access to the linked RTM account. Protect it accordingly — restrict file permissions (`chmod 600`) or remove after use if not needed persistently.
- **Network:** All API calls go to `api.rememberthemilk.com` and `www.rememberthemilk.com` only. No other outbound connections.
- **Permissions:** The auth flow requests `delete` permission (RTM's highest tier) to support task deletion. Use a dedicated API key with minimum needed scope if preferred.

## Commands

• Confidence: 89% confidence
• Finding: The skill has broad effective access to secrets, persistent local storage, and network operations, and the auth flow requests RTM's highest 'delete' permission. Combined with a plaintext long-lived token in ~/.rtm_token, compromise or misuse could allow full remote task manipulation and local credential exposure. The context increases risk because this is an account-management skill handling real user data and destructive operations.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

- **Env vars:** `RTM_API_KEY` and `RTM_SHARED_SECRET` are required at runtime. Configure via OpenClaw skill env, not hardcoded.
- **Auth token:** Stored as plain text at `~/.rtm_token` after interactive auth. This file grants full access to the linked RTM account. Protect it accordingly — restrict file permissions (`chmod 600`) or remove after use if not needed persistently.
- **Network:** All API calls go to `api.rememberthemilk.com` and `www.rememberthemilk.com` only. No other outbound connections.
- **Permissions:** The auth flow requests `delete` permission (RTM's highest tier) to support task deletion. Use a dedicated API key with minimum needed scope if preferred.

## Commands

• Confidence: 86% confidence
• Finding: Requesting RTM's highest 'delete' scope for the entire skill is broader than necessary for many common operations like listing, searching, tagging, or setting due dates. If the token is stolen or the skill is misused, the extra privilege enables destructive account actions that would otherwise be impossible. Because the token persists on disk, excessive privilege materially expands the blast radius.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.