Todoist Project Automator
Warn
Audited by Socket on Oct 4, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The core function is plausible and the Todoist MCP endpoint appears official, but the skill relies on an unpinned third-party bridge package (mcp-remote) that likely handles OAuth tokens and workspace actions. The purpose is only partially transparent because it advertises direct REST/Sync API automation while operationally routing through MCP and third-party code.
Confidence: 90%Severity: 72%
Audit Metadata