Todoist

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 0.2.1
• Hash: 3b69e575f11a7c79036e76ddb7b1da5caf1e0d41b06cf0fd5e5858d8f6578b05
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. It provides instructions for installing and using the `todoist-ts-cli` to manage Todoist tasks. All commands and usage examples are directly related to Todoist functionality. The `SKILL.md` file requires an external npm package (`todoist-ts-cli`) for installation, which is a standard dependency management practice and does not inherently indicate malicious intent within this skill bundle. It also correctly specifies the need for a `TODOIST_API_TOKEN` environment variable for authentication, which is a secure practice. There are no signs of data exfiltration, persistence mechanisms, prompt injection attempts against the agent, or other malicious behaviors.