Todoist

Manage tasks and projects in Todoist. Use when user asks about tasks, to-dos, reminders, or productivity.

Security Scan

The skill's runtime instructions match a Todoist CLI usage, but the registry metadata doesn't declare the npm install, required binary, or the TODOIST_API_TOKEN that the SKILL.md explicitly requires — this mismatch is concerning and should be clarified before installing or running it.

Purpose & Capability

The SKILL.md describes a Todoist CLI and its commands (adding, listing, completing tasks) which is coherent with the skill name and description. However, the skill's embedded metadata (in SKILL.md) lists required binary 'todoist' and env var 'TODOIST_API_TOKEN' while the registry-level metadata provided to you lists no required binaries or env vars — a clear inconsistency between what the skill claims it needs and what the registry declares.

Instruction Scope

The instructions are narrowly scoped to installing and using a Todoist CLI: installing via npm, authenticating with a Todoist API token, and running typical task-management commands. They do not instruct reading arbitrary files or exfiltrating data to third-party endpoints beyond Todoist.

Install Mechanism

There is no formal install spec in the registry, but SKILL.md instructs 'npm install -g todoist-ts-cli@^0.2.0' — an npm global package install from the public registry (moderate-risk, expected for a CLI). This is not an arbitrary URL download, but the registry should have declared the dependency and required runtime (node/npm) — that omission is inconsistent.

Credentials

The CLI legitimately needs a Todoist API token (TODOIST_API_TOKEN) to operate. But the registry metadata you were given lists no required env vars or primary credential while the SKILL.md requires TODOIST_API_TOKEN and suggests running 'todoist auth <token>' (which typically persists credentials). The missing declaration of this credential and of where/how it will be stored is a proportionality and transparency concern.

Persistence & Privilege

The skill does not request always:true and does not require system-wide privileges. However, following its instructions will likely cause the CLI to write authentication state to disk (via 'todoist auth' or local npm package config). The registry did not declare any required config paths or note this local persistence.

What to consider before installing

What to consider before installing or using this skill: - The SKILL.md expects you to install a third-party npm package (todoist-ts-cli) and to provide a Todoist API token. The registry metadata you were shown does not list these requirements — ask the publisher to reconcile that mismatch. - Verify the npm package: inspect the todoist-ts-cli package on npm (maintainer, source repo, reviews, recent releases) before installing. Prefer packages with a public GitHub repo and pinned releases. - Be careful with your API token: avoid pasting long-lived tokens into chat. If possible, use a scoped or ephemeral token, or authenticate via Todoist's official OAuth flow rather than pasting a global token. Understand where the CLI stores credentials on disk (it may persist them in your home directory). - If you must test the skill, run the npm install and CLI in a sandboxed environment (container or VM) and inspect what files/configs it writes. - Ask the skill author to update the registry metadata to declare required binaries (node/npm, todoist) and required env vars (TODOIST_API_TOKEN) and to include an explicit install spec or link to the package source. That will make the skill's intent and requirements transparent. - Given the current inconsistencies, treat this skill as potentially trustworthy but unvetted; do not install or provide secrets until the provenance and install details are confirmed.

Todoist CLI

CLI for Todoist task management, built on the official TypeScript SDK.

Installation

# Requires todoist-ts-cli >= 0.2.0 (for --top / --order)
npm install -g todoist-ts-cli@^0.2.0

Setup

1. Get API token from https://todoist.com/app/settings/integrations/developer
2. Either:

   todoist auth <your-token>
   # or
   export TODOIST_API_TOKEN="your-token"
   

Commands

Tasks

todoist                    # Show today's tasks (default)
todoist today              # Same as above
todoist tasks              # List tasks (today + overdue)
todoist tasks --all        # All tasks
todoist tasks -p "Work"    # Tasks in project
todoist tasks -f "p1"      # Filter query (priority 1)
todoist tasks --json

Add Tasks

todoist add "Buy groceries"
todoist add "Meeting" --due "tomorrow 10am"
todoist add "Review PR" --due "today" --priority 1 --project "Work"
todoist add "Prep slides" --project "Work" --order 3  # add at a specific position (1-based)
todoist add "Triage inbox" --project "Work" --order top  # add to top (alternative to --top)
todoist add "Call mom" -d "sunday" -l "family"  # with label

Manage Tasks

todoist view <id>          # View task details
todoist done <id>          # Complete task
todoist reopen <id>        # Reopen completed task
todoist update <id> --due "next week"
todoist move <id> -p "Personal"
todoist delete <id>

Search

todoist search "meeting"

Projects & Labels

todoist projects           # List projects
todoist project-add "New Project"
todoist labels             # List labels
todoist label-add "urgent"

Comments

todoist comments <task-id>
todoist comment <task-id> "Note about this task"

Usage Examples

User: "What do I have to do today?"

todoist today

User: "Add 'buy milk' to my tasks"

todoist add "Buy milk" --due "today"

User: "Remind me to call the dentist tomorrow"

todoist add "Call the dentist" --due "tomorrow"

User: "Mark the grocery task as done"

todoist search "grocery"   # Find task ID
todoist done <id>

User: "What's on my work project?"

todoist tasks -p "Work"

User: "Show my high priority tasks"

todoist tasks -f "p1"

Filter Syntax

Todoist supports powerful filter queries:

• p1, p2, p3, p4 - Priority levels
• today, tomorrow, overdue
• @label - Tasks with label
• #project - Tasks in project
• search: keyword - Search

Notes

• Task IDs are shown in task listings
• Due dates support natural language ("tomorrow", "next monday", "jan 15")
• Priority 1 is highest, 4 is lowest
• Use --order <n> (1-based) or --order top to insert a task at a specific position within a project/section