Tasks

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:07 AM UTC
• Version: 1.0.0

Overview

This task-management skill is mostly purpose-aligned, but it asks users to use task-service credentials while its Todoist-only install metadata does not match its Microsoft To-Do and Microsoft Graph token claims.

Review this before installing. Use it only if you are comfortable exposing task titles, due dates, identifiers, and completion actions to the relevant task service. Prefer a narrowly scoped Todoist token, avoid providing a broad Microsoft Graph token unless the publisher documents that integration, and install the dependency in an isolated environment with a reviewed pinned version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16 and 50–54
Vulnerability Type: Unpinned package installation from the default Python package index
Risk Level: Medium

Vulnerable code at lines 10–16:

yaml

"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "package": "todoist-api-python",
      "bins": ["todoist"],
      "label": "Install Todoist API (pip)",
    },
  ],

Vulnerable code at lines 50–54:

markdown

## Install

```bash
pip install todoist-api-python

text

### Technical Analysis

The skill instructs users or the hosting agent to install `todoist-api-python` without specifying an exact version, package hash, lock file, or trusted package repository. Consequently, pip resolves whatever release and transitive dependencies are available from its configured package index at installation time.

Python package installation can execute package-controlled build logic. If the named package, its distribution infrastructure, or one of its dependencies is compromised, malicious code could run during installation. The absence of a version constraint also makes installation behavior non-reproducible and prevents reviewers from determining which exact artifact will be used.

In addition, the metadata declares `todoist` as a required executable but provides no verification that the selected package supplies that executable. This mismatch should be validated because an incorrect package name can increase exposure to package substitution or dependency-confusion risks.

### Attack Path

1. An attacker compromises a future release of `todoist-api-python`, one of its transitive dependencies, or the package distribution channel.
2. A user or automated skill manager installs the dependency using the documented `pip install todoist-api-python` command.
3. Pip selects the attacker-controlled or compromised release because no approved version or hash is en
...[truncated 1015 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify that todoist-api-python is the intended and trusted distribution and that it actually provides the required todoist executable.
2. Pin the dependency to a reviewed exact version, for example:

   bash

   pip install todoist-api-python==<reviewed-version>
   

3. Generate and enforce cryptographic hashes using a locked requirements file and pip install --require-hashes.
4. Pin and hash all transitive dependencies rather than relying only on a top-level version constraint.
5. Use a controlled package repository or explicitly configured trusted index instead of allowing unrestricted resolution from arbitrary pip configuration.
6. Perform installation in an isolated virtual environment or sandbox under a non-privileged account.
7. Run package vulnerability and provenance checks before approving dependency updates.
8. Keep task-service credentials unavailable during installation and expose them only when the verified CLI is invoked.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest declares a Todoist CLI-based skill, but the prose expands functionality to Microsoft To-Do APIs and token-based operation that are not reflected in the declared requirements or scope. This creates a trust and review gap: users and automated tooling may approve a narrowly scoped CLI skill while the documentation encourages use of additional external services and credentials, increasing the chance of unintended token exposure or unreviewed network interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill tells users to supply Todoist or Microsoft Graph API tokens, but does not clearly disclose that task contents and metadata will be sent to external third-party services. This omission weakens informed consent and can lead users to expose sensitive task data, deadlines, or project information without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.