The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill reads task data (names, descriptions, and comments) from the Todoist API, which is an external source that can be controlled by attackers. This untrusted data is processed by the agent which has direct write and execute capabilities. An attacker could create a task containing malicious instructions that trigger the agent to perform unauthorized actions.\n
Ingestion points: todoist tasks, todoist search, todoist view, and todoist comment commands as documented in SKILL.md.\n
Boundary markers: Absent. The skill provides no instructions to separate task content from system commands.\n
Capability inventory: Command execution via todoist add, todoist delete, and todoist update.\n
Sanitization: Absent. Content is processed as raw text without filtering or escaping.\n- [Unverifiable Dependencies] (MEDIUM): The skill recommends installing a CLI binary from an untrusted GitHub repository (buddyh/todoist-cli) via brew or go install. This repository is not an official Todoist source and does not belong to the trusted organizations list, posing a supply chain risk.\n- [Command Execution] (MEDIUM): The skill is built around executing shell commands via the todoist binary. When combined with the lack of input sanitization for external content, this capability presents a risk of command injection or manipulation via the agent's logic.

todoist-cli