Todoist Project Automator

Warn

Audited by Socket on Oct 4, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core function is plausible and the Todoist MCP endpoint appears official, but the skill relies on an unpinned third-party bridge package (mcp-remote) that likely handles OAuth tokens and workspace actions. The purpose is only partially transparent because it advertises direct REST/Sync API automation while operationally routing through MCP and third-party code.

Confidence: 90%Severity: 72%
Audit Metadata
Analyzed At
Oct 4, 2026, 09:11 AM
Package URL
pkg:socket/skills-sh/agentskillexchange%2Fskills%2Ftodoist-project-automator%2F@23708967ee3a52d69d42340e0db5a9523ac2f540