Trust Assessment
todoist-api received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via Unsanitized User Input to CLI.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, dependency_graph, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via Unsanitized User Input to CLI The skill instructs the LLM to construct and execute `td` CLI commands based on user input. Many command arguments (e.g., task content, project names, filter queries, references `<ref>`) are directly derived from user input. The skill does not provide explicit instructions or mechanisms for the LLM to safely sanitize, quote, or escape these user-provided arguments before constructing the final shell command string. This creates a risk of command injection if a malicious user provides input containing shell metacharacters (e.g., `;`, `|`, `&`, `$(...)`) that are then executed by the underlying shell. While the skill requires confirmation for destructive actions, read-only commands are not protected by this, and even destructive commands could be vulnerable if the injection occurs before the confirmation prompt or if the confirmation is bypassed. Instruct the LLM to always sanitize and properly quote/escape all user-provided arguments when constructing shell commands. For Python-based execution, prefer `subprocess.run(..., shell=False, args=[command, arg1, arg2, ...])` over `shell=True` with string interpolation. If `shell=True` is necessary, explicitly instruct the LLM on how to use `shlex.quote()` or similar mechanisms for all user-controlled arguments. | Unknown | SKILL.md:100 |
Scan History
Embed Code
[](https://skillshield.io/report/6aad5e7dc3bd5a7e)
Powered by SkillShield