todoist-automation

SUSPICIOUS: The skill's capabilities fit Todoist automation, but it routes all operations and auth through a third-party hosted MCP service (Rube/Composio) instead of Todoist's official endpoints, and its setup claims are inconsistent with vendor docs about MCP auth. This is not confirmed malware, but it carries meaningful trust and data-flow risk due to intermediary credential/token handling and remote action execution.