P-Todo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:35 AM UTC
• Version: 1.0.0

Overview

This is a real P-Todo integration, but it exposes powerful unauthenticated API access that can delete app data and may write exports to arbitrary files.

Review before installing or running this skill/app. It should only be used in a trusted local environment, ideally after changing the API to bind only to loopback, adding authentication, requiring explicit confirmation for deletes and user-management changes, and restricting exports to a safe directory. Do not run it on a shared or exposed network as-is.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/main/java/com/teamtodo/api/ApiServer.java:77

Finding

Unauthenticated REST API Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/main/java/com/teamtodo/api/ApiServer.java:168

Finding

Arbitrary File Overwrite Through the Export Endpoint

Content

View full analysis

body = parseBody(exchange); String format = (String) body.getOrDefault("format", "json"); if (format == null || !(format.equalsIgnoreCase("json") || format.equalsIgnoreCase("csv"))) { sendJson(exchange, 400, Map.of("error", "Unsupported format: " + format + ", use json or csv")); return; } String path = (String) body.get("path"); if (path == null || path.isBlank()) { String dir = System.getProperty("user.home") + File.separator + "P-Todo" + File.separator + "export"; new File(dir).mkdirs(); path = dir + File.separator + "P-Todo-export." + format.toLowerCase(); } File file = format.equalsIgnoreCase("json") ? com.teamtodo.util.DataExporter.exportJson(new File(path)) : com.teamtodo.util.DataExporter.exportCsv(new File(path)); sendJson(exchange, 200, Map.of("file", file.getAbsolutePath(), "format", format.toLowerCase())); } catch (Exception e) { sendJson(exchange, 500, Map.of("error", e.getMessage())); } } ``` The path reaches truncating file-output operations: ```java public static File exportJson(File file) throws IOException { TodoService service = new TodoService(); List to ...[truncated 2405 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/main/java/com/teamtodo/api/ApiServer.java:475

Finding

Denial of Service Through Unbounded HTTP Request Bodies

Content

View full analysis

parseBody(HttpExchange exchange) throws IOException { String body = new String(exchange.getRequestBody().readAllBytes(), StandardCharsets.UTF_8); if (body.isBlank()) return new HashMap<>(); return gson.fromJson(body, Map.class); } ``` ### Technical Analysis `InputStream.readAllBytes()` reads until end-of-stream and allocates enough memory to hold the complete request body. The implementation imposes no maximum payload size and does not reject excessive `Content-Length` values. After allocating the byte array, the code creates a second UTF-8 `String` representation and then parses the input into a Gson object graph, increasing peak memory consumption further. Repeated or concurrent large requests can exhaust the Java heap or create severe garbage-collection pressure. Because the API binds to all interfaces and requires no authentication, an attacker does not need a local account or valid credentials to reach affected JSON endpoints. ### Attack Path 1. The victim starts P-Todo and its HTTP API. 2. An attacker connects to any endpoint that invokes `parseBody`, such as `POST /api/todos` or `POST /api/export`. 3. The attacker transmits a very large request body, potentially using several concurrent connections. 4. `readAllBytes()` continues allocating memory until the request ends or the process runs out of heap. 5. UTF-8 conversion and JSON parsing create additional allocations. 6. The application slows significantly, throws `OutOfMemoryError`, or terminates. ### Impact Assessment A reachable unauthenticated attacker can degrade or terminate the complete desktop application, affecting both the REST API and graphical task-management interface. Availability of task and remi ...[truncated 209 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/main/java/com/teamtodo/util/DataExporter.java:46

Finding

Spreadsheet Formula Injection in CSV Exports

Content

View full analysis

todos = service.listAll(); try (PrintWriter pw = new PrintWriter(new OutputStreamWriter(new FileOutputStream(file), StandardCharsets.UTF_8))) { pw.println(I18n.t("csv.header")); for (Todo t : todos) { pw.printf("\"%s\",\"%s\",\"%s\",\"%s\",\"%s\",\"%s\",\"%s\"%n", escape(t.getTitle()), t.getStatus() != null ? t.getStatus().getLabel() : "", t.getPriority() != null ? t.getPriority().getLabel() : "", t.getDueDate() != null ? t.getDueDate() : "", t.isCompleted() ? I18n.t("csv.yes") : I18n.t("csv.no"), t.getCreatedAt() != null ? t.getCreatedAt().format(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm")) : "", escape(t.getDescription() != null ? t.getDescription() : "")); } log.info("已导出 CSV: {} ({} 条)", file.getAbsolutePath(), todos.size()); } return file; } private static String escape(String s) { if (s == null) return ""; return s.replace("\"", "\"\"").replace("\n", " ").replace("\r", ""); } ``` ### Technical Analysis The escaping routine protects CSV structure by doubling quotes and removing line breaks, but it does not neutralize spreadsheet formula prefixes. Spreadsheet applications may interpret cells beginning with `=`, `+`, `-`, or `@` as formulas even when the values are CSV-quoted. Todo titles and descriptions are attacker-controlled through the REST API. An attacker can therefore store a formula-prefixed value that is later included verbatim in a CSV export. Actual formula behavior depends on the spreadsheet application an ...[truncated 1288 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (148)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The skill exposes a direct delete-todo endpoint with a user-supplied identifier and no mention of validation, scoping, or confirmation. In a skill that may be broadly triggered, this enables unintended or manipulated deletion of local application data.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

GET /api/todos/{id} 获取单个待办 POST /api/todos 创建待办（body: {title, description, priority, assignee_id, due_date, tags}） PUT /api/todos/{id} 更新待办 DELETE /api/todos/{id} 删除待办 POST /api/todos/{id}/complete 切换完成状态

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The comment deletion endpoint allows direct destructive action based only on an ID, with no safety guidance or guardrails described. If the assistant is induced to pass attacker-chosen IDs, comments can be removed without adequate user awareness or verification.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

text

GET    /api/todos/{id}/comments  获取待办评论
POST   /api/todos/{id}/comments  添加评论（body: {user_id, content}）
DELETE /api/comments/{id}        删除评论

用户管理

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Deleting users is a high-impact administrative action, yet the skill documents it as a simple direct endpoint with no warnings or controls. This creates a clear tool-parameter-abuse risk if the assistant passes an incorrect or manipulated user ID.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

GET /api/users 获取所有用户 POST /api/users 创建用户（body: {name}） PUT /api/users/{id} 更新用户 DELETE /api/users/{id} 删除用户

text

### 统计与搜索

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This Traditional Chinese duplicate documents the same direct todo deletion path without safeguards. The localized repetition increases exposure because the same unsafe destructive pattern is available across languages.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

GET /api/todos/{id} 取得單個待辦 POST /api/todos 建立待辦（body: {title, description, priority, assignee_id, due_date, tags}） PUT /api/todos/{id} 更新待辦 DELETE /api/todos/{id} 刪除待辦 POST /api/todos/{id}/complete 切換完成狀態

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate comment deletion endpoint presents the same risk of unverified destructive action by identifier alone. Localized availability does not reduce the danger; it broadens the situations in which unsafe deletion may be invoked.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

text

GET    /api/todos/{id}/comments  取得待辦評論
POST   /api/todos/{id}/comments  新增評論（body: {user_id, content}）
DELETE /api/comments/{id}        刪除評論

使用者管理

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This user deletion endpoint again exposes a sensitive administrative action with no mention of privilege checks or confirmation. Incorrect routing or parameter injection could remove user records and disrupt the application.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

GET /api/users 取得所有使用者 POST /api/users 建立使用者（body: {name}） PUT /api/users/{id} 更新使用者 DELETE /api/users/{id} 刪除使用者

text

### 統計與搜尋

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The English documentation explicitly includes direct todo deletion by ID without any safety controls. In the context of a local productivity app, this threatens data integrity and is made worse by the broad trigger list elsewhere in the skill.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

GET /api/todos/{id} Get single todo POST /api/todos Create todo (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} Update todo DELETE /api/todos/{id} Delete todo POST /api/todos/{id}/complete Toggle completion

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Direct comment deletion by ID is documented without safeguards, enabling accidental or manipulated destructive use. A model or user could supply the wrong identifier and irreversibly remove discussion history.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

text

GET    /api/todos/{id}/comments  Get comments
POST   /api/todos/{id}/comments  Add comment (body: {user_id, content})
DELETE /api/comments/{id}        Delete comment

User Management

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Direct user deletion is particularly sensitive because it can affect accounts and ownership relationships, yet the skill describes it as a normal routine call. Without clear guardrails, the assistant may perform high-impact administrative changes too easily.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

GET /api/users List users POST /api/users Create user (body: {name}) PUT /api/users/{id} Update user DELETE /api/users/{id} Delete user

text

### Statistics & Search

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This Japanese duplicate again exposes unsafeguarded todo deletion by ID. Because the skill is multilingual, the lack of controls applies broadly and increases the operational risk of destructive mistakes.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

GET /api/todos/{id} 単一タスク取得 POST /api/todos タスク作成（body: {title, description, priority, assignee_id, due_date, tags}） PUT /api/todos/{id} タスク更新 DELETE /api/todos/{id} タスク削除 POST /api/todos/{id}/complete 完了状態切替

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The Japanese comment deletion endpoint remains a direct destructive path without described constraints. That makes abuse or accidental invocation plausible if IDs are inferred or supplied incorrectly.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

text

GET    /api/todos/{id}/comments  コメント取得
POST   /api/todos/{id}/comments  コメント追加（body: {user_id, content}）
DELETE /api/comments/{id}        コメント削除

ユーザー管理

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This localized user deletion endpoint preserves the same high-impact administrative risk with no documented safeguards. Deleting users through a conversational skill should be treated as privileged, not routine.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

GET /api/users ユーザー一覧 POST /api/users ユーザー作成（body: {name}） PUT /api/users/{id} ユーザー更新 DELETE /api/users/{id} ユーザー削除

text

### 統計・検索

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The Korean section exposes direct todo deletion by ID with no guardrails. Given the broad activation terms, this combination materially increases the chance of unintended destructive operations on local data.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

GET /api/todos/{id} 단일 할일 조회 POST /api/todos 할일 생성 (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} 할일 수정 DELETE /api/todos/{id} 할일 삭제 POST /api/todos/{id}/complete 완료 상태 전환

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Comment deletion in the Korean section is documented as a simple ID-based destructive call with no context verification. This can result in accidental or attacker-influenced removal of records.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

text

GET    /api/todos/{id}/comments  댓글 조회
POST   /api/todos/{id}/comments  댓글 추가 (body: {user_id, content})
DELETE /api/comments/{id}        댓글 삭제

사용자 관리

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The Korean user deletion endpoint similarly lacks mention of role restrictions, review, or confirmation. Because user deletion is administrative, this is a significant misuse risk in a conversational tool setting.

Content

Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.

GET /api/users 사용자 목록 POST /api/users 사용자 생성 (body: {name}) PUT /api/users/{id} 사용자 수정 DELETE /api/users/{id} 사용자 삭제

text

### 통계 및 검색

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The French section again includes hard deletion of todos by identifier only, with no control guidance. This is dangerous because a conversation agent may select or receive the wrong ID and irreversibly alter user data.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

GET /api/todos/{id} Obtenir une tâche POST /api/todos Créer une tâche (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} Modifier une tâche DELETE /api/todos/{id} Supprimer une tâche POST /api/todos/{id}/complete Basculer l'achèvement

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Direct comment deletion by ID remains an unsafe destructive pattern in the French locale as well. The skill context makes this more dangerous because the documented operations are intended for automated execution, not manual administrative review.

Content

Scanner excerpt · SKILL.md (reported line 416)May include surrounding context.

text

GET    /api/todos/{id}/comments  Obtenir les commentaires
POST   /api/todos/{id}/comments  Ajouter un commentaire (body: {user_id, content})
DELETE /api/comments/{id}        Supprimer un commentaire

Gestion des utilisateurs

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Deleting users through the French section is documented without any privilege or safety constraints. This can cause account disruption and associated data integrity problems if abused or mistakenly invoked.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

GET /api/users Lister les utilisateurs POST /api/users Créer un utilisateur (body: {name}) PUT /api/users/{id} Modifier un utilisateur DELETE /api/users/{id} Supprimer un utilisateur

text

### Statistiques et recherche

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The German section repeats the direct todo deletion endpoint without safeguards, preserving the same integrity risk. In combination with loose triggers, an unintended activation could lead to silent local data loss.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

GET /api/todos/{id} Einzelne Aufgabe abrufen POST /api/todos Aufgabe erstellen (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} Aufgabe bearbeiten DELETE /api/todos/{id} Aufgabe löschen POST /api/todos/{id}/complete Abschluss umschalten

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The German comment deletion endpoint exposes an unguarded destructive operation based solely on an ID. This is risky in conversational automation where parameter selection may be ambiguous.

Content

Scanner excerpt · SKILL.md (reported line 492)May include surrounding context.

text

GET    /api/todos/{id}/comments  Kommentare abrufen
POST   /api/todos/{id}/comments  Kommentar hinzufügen (body: {user_id, content})
DELETE /api/comments/{id}        Kommentar löschen

Benutzerverwaltung

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

User deletion in the German section is a high-impact administrative action documented with no controls. Misuse could remove accounts and undermine application access or ownership structures.

Content

Scanner excerpt · SKILL.md (reported line 500)May include surrounding context.

GET /api/users Benutzer auflisten POST /api/users Benutzer erstellen (body: {name}) PUT /api/users/{id} Benutzer bearbeiten DELETE /api/users/{id} Benutzer löschen

text

### Statistiken und Suche

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The Spanish section again documents direct todo deletion by ID without any warnings or validation requirements. This makes destructive misuse straightforward in an agent-mediated workflow.

Content

Scanner excerpt · SKILL.md (reported line 560)May include surrounding context.

GET /api/todos/{id} Obtener una tarea POST /api/todos Crear tarea (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} Actualizar tarea DELETE /api/todos/{id} Eliminar tarea POST /api/todos/{id}/complete Alternar finalización

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Comment deletion in the Spanish section is another unsafe ID-based destructive action lacking safeguards. Incorrect resolution of the target comment could irreversibly remove content.

Content

Scanner excerpt · SKILL.md (reported line 568)May include surrounding context.

text

GET    /api/todos/{id}/comments  Obtener comentarios
POST   /api/todos/{id}/comments  Añadir comentario (body: {user_id, content})
DELETE /api/comments/{id}        Eliminar comentario

Gestión de usuarios

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The Spanish documentation includes user deletion as a standard endpoint with no mention of privilege or confirmation. This is dangerous because account-level destructive actions should not be casually exposed through broad conversational triggers.

Content

Scanner excerpt · SKILL.md (reported line 576)May include surrounding context.

GET /api/users Listar usuarios POST /api/users Crear usuario (body: {name}) PUT /api/users/{id} Actualizar usuario DELETE /api/users/{id} Eliminar usuario

text

### Estadísticas y búsqueda

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The Portuguese section also exposes direct todo deletion without controls, continuing the same destructive misuse risk. Localhost scope reduces internet exposure but not the risk of local data loss through accidental or manipulated invocation.

Content

Scanner excerpt · SKILL.md (reported line 636)May include surrounding context.

GET /api/todos/{id} Obter uma tarefa POST /api/todos Criar tarefa (body: {title, description, priority, assignee_id, due_date, tags}) PUT /api/todos/{id} Atualizar tarefa DELETE /api/todos/{id} Excluir tarefa POST /api/todos/{id}/complete Alternar conclusão

text

Static analysis

No suspicious patterns detected.