ticktick-calendar

• Analyzed: May 12, 2026, 4:21 AM
• Findings: 1
• Version: 0.1.2
• Hash: 53ac0ebe3af371abab227e0d5f29799aa4415fefd547f31fcf5bfe6c4acd9f72
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a data exfiltration risk via the reauthorization webhook mechanism. The `skill-entry/token-manager.mjs` file implements a feature to send sensitive OAuth parameters (`authUrl`, `state`) to a user-configurable `TICKTICK_REAUTH_WEBHOOK_URL` when reauthorization is required. While the `SKILL.md` and `README.md` describe this for a legitimate notification purpose, an attacker could potentially set `TICKTICK_REAUTH_WEBHOOK_URL` to an endpoint they control, leading to unauthorized exfiltration of these sensitive OAuth details. The code enforces HTTPS for the webhook, which is a good security practice, but does not prevent exfiltration to an attacker-controlled HTTPS server.