Microsoft To Do

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Microsoft To Do helper, but it needs review because it can delete tasks or lists while bypassing confirmations and stores Microsoft app credentials in a local plaintext file.

Review before installing. Use this only if you are comfortable giving a third-party CLI access to your Microsoft To Do account, protect keys.yml and token files with owner-only permissions, prefer short-lived/rotated Azure secrets, pin or verify the CLI package version where possible, and require explicit confirmation before any task or list deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party CLI Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 and line 29 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml "install": [ { "id": "pip", "kind": "uv", "package": "microsoft-todo-cli", "bins": ["todo"], "label": "Install microsoft-todo-cli (pip/uv)", }, ], ``` The prerequisite documentation also recommends an unpinned installation: ```markdown 1. `todo` CLI installed (`pip install microsoft-todo-cli`) ``` ### Technical Analysis The installation metadata and prerequisite instructions install `microsoft-todo-cli` without specifying a reviewed version or verifying an integrity hash. Consequently, package resolution selects whichever release is current at installation time. This creates a supply-chain exposure because the effective code installed and executed can change after this Skill has been reviewed. A compromised package publisher account, malicious future release, or upstream distribution-channel compromise could introduce arbitrary installation-time or runtime behavior. There is no evidence in the audited files that the current package is malicious. The issue is the absence of controls that ensure users receive the same reviewed dependency version. ### Attack Path 1. An attacker compromises the package publisher, release process, or relevant package-distribution channel. 2. The attacker publishes a malicious release under the expected `microsoft-todo-cli` package name. 3. A user installs the dependency using the documented unpinned `pip` or `uv` command. 4. The package manager resolves and installs the attacker-controlled release. 5. Malicious package code executes during installation or when the `todo` command is invoked. 6. The code operates with the privileges of the installing user and may access files, credentials, OAuth tokens, and Microsoft To Do data available to that account. ### Impact Assessment Successful e ...[truncated 561 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `microsoft-todo-cli` to a specific version that has been reviewed: ```yaml "package": "microsoft-todo-cli==<reviewed-version>" ``` Update the prerequisite command accordingly: ```bash pip install "microsoft-todo-cli==<reviewed-version>" ``` 2. Use a lock file or requirements file containing cryptographic hashes, and install with hash verification where supported: ```text microsoft-todo-cli==<reviewed-version> \ --hash=sha256:<verified-distribution-hash> ``` 3. Document the expected official package index and upstream repository so users can verify provenance. 4. Review dependency updates before changing the pinned version. Validate package ownership, release signatures or hashes, dependency changes, and installed artifacts. 5. Avoid privileged installation. Install the CLI in an isolated virtual environment or user-scoped environment with the minimum necessary filesystem access. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/setup.md:34
• Finding: Azure Client Secret Stored Without Explicit Filesystem Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md`, lines 34–47 **Vulnerability Type**: Plaintext credential storage with unspecified permissions **Risk Level**: Low ### Vulnerable Code ```markdown ## Step 5: Configure todo Create the config file: ```bash mkdir -p ~/.config/microsoft-todo-cli ``` Add your credentials to `~/.config/microsoft-todo-cli/keys.yml`: ```yaml client_id: "your-application-client-id" client_secret: "your-client-secret-value" ``` ``` ### Technical Analysis The setup instructions require a reusable Azure application client secret to be written in plaintext to `~/.config/microsoft-todo-cli/keys.yml`. They do not create the directory with an explicit restrictive mode, secure the resulting file with mode `600`, verify ownership, or recommend an operating-system-backed secret store. The actual permissions therefore depend on the user's umask and the editor or command used to create the file. Under permissive local configurations, the directory or credential file may be readable by other local accounts or processes. A client secret is an application credential rather than the user's OAuth token. Its practical value depends on the Azure application configuration and OAuth flow. Nevertheless, disclosure can enable unauthorized use or impersonation of the registered application and may contribute to attacks against its OAuth configuration. ### Attack Path 1. A user follows the setup instructions and creates the configuration directory and `keys.yml`. 2. The user's umask or chosen editor creates the credential file with group-readable or world-readable permissions. 3. An attacker who already has access as another local account, or a process operating outside the intended trust boundary, enumerates the documented path. 4. The attacker reads `~/.config/microsoft-todo-cli/keys.yml` and extracts the client ID and client secret. 5. The attacker uses the secret to impersonate the registered application in OAuth reques ...[truncated 883 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the configuration directory with owner-only access: ```bash install -d -m 700 ~/.config/microsoft-todo-cli ``` 2. Create the credential file with owner-only read/write permissions before editing it: ```bash install -m 600 /dev/null ~/.config/microsoft-todo-cli/keys.yml ``` 3. Instruct users to verify permissions and ownership: ```bash chmod 700 ~/.config/microsoft-todo-cli chmod 600 ~/.config/microsoft-todo-cli/keys.yml test "$(stat -c '%U' ~/.config/microsoft-todo-cli/keys.yml)" = "$USER" ``` 4. Prefer an OS-backed credential manager or secret-storage service instead of a plaintext YAML file. 5. If supported by the CLI and Azure configuration, use a public-client OAuth flow that does not require distributing or locally storing a client secret. 6. Configure a short secret lifetime, rotate the secret regularly, and revoke it immediately if exposure is suspected. 7. Ensure OAuth token files, including `token.json`, receive equivalent owner-only permissions. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent

Content

todo tasks --completed --json            # Done tasks
todo tasks --all --json                  # Everything

# Create task
todo new "Task name" --json              # Basic
todo new "Task" -l Work --json           # In specific list
todo new "Task" -d tomorrow --json       # With due date

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents irreversible task deletion using `todo rm "Task" -y --json` without any warning or requirement for user confirmation. In an agentic context, explicitly instructing use of `-y` increases the chance the agent will delete user data without an interactive safety check, especially if task names are ambiguous or selected incorrectly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented `rm-list "Project X" -y --json` command can permanently remove an entire task list and potentially all contained tasks, yet no warning is given about the destructive scope. In a skill intended for automated use, this creates a meaningful risk of large-scale accidental data loss.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Notes

- **Always use `--json`** for all commands to get structured output
- **Always use `-y`** with `rm` commands to skip confirmation
- Use `--id` with `-l ListName` for list context
- First run opens browser for OAuth authentication

• Confidence: 97% confidence
• Finding: The note to 'Always use `-y` with `rm` commands to skip confirmation' encourages autonomous execution of destructive actions without a human-in-the-loop check. That is dangerous in agent workflows because confirmation prompts are a built-in safeguard against mis-targeting, hallucinated identifiers, or misunderstood user intent.

Session Persistence

Medium

• Category: Rogue Agent

Content

After registration, you'll see the **Application (client) ID** on the overview page. Copy this value.

## Step 4: Create a Client Secret

1. In the left menu, click **Certificates & secrets**
2. Click **New client secret**

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup guide instructs users to place a long-lived OAuth client secret directly into a plaintext config file under their home directory, without any guidance on file permissions, secret storage, or rotation. This increases the chance of credential disclosure via local compromise, backups, dotfile syncing, or accidental sharing, which could allow unauthorized access to the registered Microsoft application context.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Step 6: First Run

Run any command to trigger OAuth login:

```bash
todo lists

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

**Token expired**

- Delete `~/.config/microsoft-todo-cli/token.json` and run any command to re-authenticate

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Static analysis

No suspicious patterns detected.