ClawHub
Back to skill

Security audit

Tasks

Security checks for vulnerabilities and agentic risk

Overview

This task-management skill is mostly purpose-aligned, but it asks users to use task-service credentials while its Todoist-only install metadata does not match its Microsoft To-Do and Microsoft Graph token claims.

Review this before installing. Use it only if you are comfortable exposing task titles, due dates, identifiers, and completion actions to the relevant task service. Prefer a narrowly scoped Todoist token, avoid providing a broad Microsoft Graph token unless the publisher documents that integration, and install the dependency in an isolated environment with a reviewed pinned version where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding
Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 10–16 and 50–54 **Vulnerability Type**: Unpinned package installation from the default Python package index **Risk Level**: Medium **Vulnerable code at lines 10–16:** ```yaml "install": [ { "id": "pip", "kind": "pip", "package": "todoist-api-python", "bins": ["todoist"], "label": "Install Todoist API (pip)", }, ], ``` **Vulnerable code at lines 50–54:** ```markdown ## Install ```bash pip install todoist-api-python ``` ``` ### Technical Analysis The skill instructs users or the hosting agent to install `todoist-api-python` without specifying an exact version, package hash, lock file, or trusted package repository. Consequently, pip resolves whatever release and transitive dependencies are available from its configured package index at installation time. Python package installation can execute package-controlled build logic. If the named package, its distribution infrastructure, or one of its dependencies is compromised, malicious code could run during installation. The absence of a version constraint also makes installation behavior non-reproducible and prevents reviewers from determining which exact artifact will be used. In addition, the metadata declares `todoist` as a required executable but provides no verification that the selected package supplies that executable. This mismatch should be validated because an incorrect package name can increase exposure to package substitution or dependency-confusion risks. ### Attack Path 1. An attacker compromises a future release of `todoist-api-python`, one of its transitive dependencies, or the package distribution channel. 2. A user or automated skill manager installs the dependency using the documented `pip install todoist-api-python` command. 3. Pip selects the attacker-controlled or compromised release because no approved version or hash is en ...[truncated 1015 chars]
Remediation
## Remediation Suggestions 1. Verify that `todoist-api-python` is the intended and trusted distribution and that it actually provides the required `todoist` executable. 2. Pin the dependency to a reviewed exact version, for example: ```bash pip install todoist-api-python==<reviewed-version> ``` 3. Generate and enforce cryptographic hashes using a locked requirements file and `pip install --require-hashes`. 4. Pin and hash all transitive dependencies rather than relying only on a top-level version constraint. 5. Use a controlled package repository or explicitly configured trusted index instead of allowing unrestricted resolution from arbitrary pip configuration. 6. Perform installation in an isolated virtual environment or sandbox under a non-privileged account. 7. Run package vulnerability and provenance checks before approving dependency updates. 8. Keep task-service credentials unavailable during installation and expose them only when the verified CLI is invoked.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest declares a Todoist CLI-based skill, but the prose expands functionality to Microsoft To-Do APIs and token-based operation that are not reflected in the declared requirements or scope. This creates a trust and review gap: users and automated tooling may approve a narrowly scoped CLI skill while the documentation encourages use of additional external services and credentials, increasing the chance of unintended token exposure or unreviewed network interactions.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill tells users to supply Todoist or Microsoft Graph API tokens, but does not clearly disclose that task contents and metadata will be sent to external third-party services. This omission weakens informed consent and can lead users to expose sensitive task data, deadlines, or project information without understanding the privacy implications.

Static analysis

No suspicious patterns detected.