Security audit

Easy TODO list management for busy crustaceans and their humans

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local TODO-list skill, with some operational risks around automatic reminders and fragile local storage handling.

Install this only if you want a local TODO manager that can generate scheduled summaries and create recurring task instances automatically. Keep backups for important task data, avoid setting TODOS_FILE to unrelated paths, and be cautious about adding untrusted task text because the current storage parser can corrupt the TODO file if reserved markers appear in task content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: cli.js:105
Finding: Store Delimiter Injection Can Corrupt Parsing and Erase Existing TODO Data
Content: View full analysis
"'); const store = readStore(); const task = { id: nextId(store, "T"), title, notes: flags["notes"] || undefined, dueDate: flags["due"] || undefined, priority: flags["priority"] || "medium", status: "active", createdAt: new Date().toISOString(), tags: flags["tags"] ? flags["tags"].split(",").map(s => s.trim()) : [], }; store.tasks.push(task); writeStore(store); const due = task.dueDate ? ` (due ${task.dueDate})` : ""; const prio = task.priority !== "medium" ? ` [${task.priority}]` : ""; console.log(`Added ${task.id}: ${task.title}${due}${prio}`); } ``` ### Technical Analysis The application embeds a JSON document inside Markdown using the textual markers ``. It retrieves the end of the JSON document with: ```js const e = content.indexOf(STORE_END); ``` Task ...[truncated 2456 chars]
Remediation: View remediation
`, `

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
The file is managed entirely by `cli.js` — never edit it by hand. It contains a JSON block (machine-readable) and Markdown tables (human-readable) that are rege

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill invokes a local Node CLI and accesses a persistent file in the user's home directory, but it does not declare any explicit tool scope such as allowed tools or permissions. That makes the execution boundary unclear and can enable broader-than-expected code or environment access if the platform defaults are permissive, reducing transparency and increasing the chance of unintended actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to automatically run scheduled briefings and a daily materialize action without waiting for a user request. This creates autonomous reads and writes against user task data, which can surprise users, generate unsolicited messages, and modify state without explicit opt-in or runtime confirmation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI allows the output file path to be fully controlled by the TODOS_FILE environment variable, and later reads from and writes to that path without restriction. In an agent or skill execution context, environment variables may be influenced externally, so this can redirect writes to unintended files and cause data overwrite or disclosure outside the expected TODO store location.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Because writeStore() writes directly to TODOS_FILE, a caller can silently redirect the CLI's persistent output to any filesystem path writable by the process. The lack of any user-facing warning or path validation makes this especially risky in automated agent settings, where a seemingly harmless TODO operation could overwrite unrelated files.
Content: No source excerpt is available for this finding.