Microsoft To Do

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Microsoft To Do helper, but it needs review because it can delete tasks or lists while bypassing confirmations and stores Microsoft app credentials in a local plaintext file.

Review before installing. Use this only if you are comfortable giving a third-party CLI access to your Microsoft To Do account, protect keys.yml and token files with owner-only permissions, prefer short-lived/rotated Azure secrets, pin or verify the CLI package version where possible, and require explicit confirmation before any task or list deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Remediation

View remediation

" ``` Update the prerequisite command accordingly: ```bash pip install "microsoft-todo-cli==" ``` 2. Use a lock file or requirements file containing cryptographic hashes, and install with hash verification where supported: ```text microsoft-todo-cli== \ --hash=sha256: ``` 3. Document the expected official package index and upstream repository so users can verify provenance. 4. Review dependency updates before changing the pinned version. Validate package ownership, release signatures or hashes, dependency changes, and installed artifacts. 5. Avoid privileged installation. Install the CLI in an isolated virtual environment or user-scoped environment with the minimum necessary filesystem access. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/setup.md:34

Finding

Azure Client Secret Stored Without Explicit Filesystem Access Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

todo tasks --completed --json            # Done tasks
todo tasks --all --json                  # Everything

# Create task
todo new "Task name" --json              # Basic
todo new "Task" -l Work --json           # In specific list
todo new "Task" -d tomorrow --json       # With due date

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents irreversible task deletion using todo rm "Task" -y --json without any warning or requirement for user confirmation. In an agentic context, explicitly instructing use of -y increases the chance the agent will delete user data without an interactive safety check, especially if task names are ambiguous or selected incorrectly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented rm-list "Project X" -y --json command can permanently remove an entire task list and potentially all contained tasks, yet no warning is given about the destructive scope. In a skill intended for automated use, this creates a meaningful risk of large-scale accidental data loss.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The note to 'Always use -y with rm commands to skip confirmation' encourages autonomous execution of destructive actions without a human-in-the-loop check. That is dangerous in agent workflows because confirmation prompts are a built-in safeguard against mis-targeting, hallucinated identifiers, or misunderstood user intent.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

## Notes

- **Always use `--json`** for all commands to get structured output
- **Always use `-y`** with `rm` commands to skip confirmation
- Use `--id` with `-l ListName` for list context
- First run opens browser for OAuth authentication

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 27)May include surrounding context.

md

After registration, you'll see the **Application (client) ID** on the overview page. Copy this value.

## Step 4: Create a Client Secret

1. In the left menu, click **Certificates & secrets**
2. Click **New client secret**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to place a long-lived OAuth client secret directly into a plaintext config file under their home directory, without any guidance on file permissions, secret storage, or rotation. This increases the chance of credential disclosure via local compromise, backups, dotfile syncing, or accidental sharing, which could allow unauthorized access to the registered Microsoft application context.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/setup.md (reported line 52)May include surrounding context.

Step 6: First Run

Run any command to trigger OAuth login:

bash

todo lists

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.

md

**Token expired**

- Delete `~/.config/microsoft-todo-cli/token.json` and run any command to re-authenticate

Static analysis

No suspicious patterns detected.