ticktick-official-cli
PassAudited by ClawScan on May 10, 2026.
Overview
The skill appears to do what it claims—manage Dida365 tasks via official OAuth—but it stores/prints read-write credentials and can change or delete tasks, so users should handle it carefully.
This looks like a coherent Dida365 integration. Before installing, be comfortable granting read/write task access, keep ~/.config/ticktick-official private, redact any printed tokens, do not change the API base URL away from official Dida365 endpoints, and require confirmation before any delete command.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If authorized, the agent can change or delete items in the user's Dida365 account.
The skill can create, update, complete, and delete Dida365 tasks/projects. This matches the stated purpose, but deletion and account mutation are high-impact actions.
管理滴答清单（项目/任务查询、创建、更新、完成、删除） ... 删除操作（project/task delete）属于危险操作，执行前确认
Require explicit user confirmation for delete operations and review project/task IDs before running mutation commands.
Anyone who can read those local config files may be able to access or modify the user's Dida365 tasks.
The OAuth flow uses read/write task scope and persists both the app client secret and access token in local config files.
DEFAULT_SCOPE = "tasks:read tasks:write" ... f'export {ENV_CLIENT_SECRET}="{client_secret}"\n' ... f'export TICKTICK_TOKEN="{access_token}"\n'Store the config directory securely, avoid sharing these files, and revoke/regenerate the Dida365 app secret or token if exposed.
The Dida365 token could be copied into logs or chat history if the exchange output is shared.
The manual token exchange command prints the token response and export command to the terminal, which can place the access token in agent transcripts or logs.
console.print_json(data=payload) ... console.print(f'export TICKTICK_TOKEN="{access_token}"')Prefer saving tokens without sharing command output, redact tokens from transcripts, and avoid posting terminal logs from the OAuth exchange.
Misconfiguring --base-url or TICKTICK_BASE_URL could send the OAuth token to an unintended server.
The CLI allows the API base URL to be overridden while using the bearer token. The default is official Dida365, but a non-official URL could receive the token if configured.
base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url", envvar=ENV_BASE_URL, help="API base URL.") ... TicktickApiClient(token=token, base_url=base_url
Leave the default API URL in place unless deliberately testing, and only use dida365.com/api.dida365.com endpoints for real credentials.
First run may depend on resolving external Python packages, which can affect reproducibility and supply-chain assurance.
The script is designed to run through uv with runtime Python dependencies specified by version ranges rather than exact pins.
#!/usr/bin/env -S uv run --script ... dependencies = [ "httpx>=0.28.1", "typer>=0.20.1", "pydantic>=2.12.5", "rich>=14.2.0" ]
Run only in a trusted environment, consider pinning dependencies or using a lockfile, and ensure uv/package sources are trusted.