Security audit
Security checks across malware telemetry and agentic risk
The skill does what it says, but it needs review because it tells agents to bypass delete confirmations for Microsoft To Do data and gives weak guidance for stored OAuth secrets.
Install only if you trust the upstream `microsoft-todo-cli` package and are comfortable granting it Microsoft To Do access. Require explicit confirmation before any task, step, note, or list deletion, preferably after the agent shows the exact target and uses a stable ID. Treat `keys.yml` and OAuth token files as secrets: restrict local file permissions, do not paste or log their contents, and rotate the Azure client secret if it is exposed.
## Notes - **Always use `--json`** for all commands to get structured output - **Always use `-y`** with `rm` commands to skip confirmation - Use `--id` with `-l ListName` for list context - First run opens browser for OAuth authentication
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.
