Todoist

Use the td (Todoist CLI) to read and manage Todoist todos/to-dos/tasks from the terminal. Trigger when the user asks about their todos/tasks/agenda/checklist (today/upcoming/overdue), wants to list inbox/tasks/projects/labels, add a task/todo with natural language, or update/complete/delete/move tasks (e.g., add a phone number to a task description, change due dates, priorities, labels).

This skill appears to be what it claims: a set of instructions to use the td CLI for Todoist. Before installing or running any commands: (1) review the linked GitHub repo and its package.json/postinstall scripts to ensure nothing unexpected runs during npm install; (2) prefer installing from a vetted release or your package manager if available; (3) be aware the td CLI needs Todoist authentication — supplying your API token will let the agent operate on your tasks, so only provide it if you trust the skill; (4) follow the SKILL.md safety advice (confirm before deleting) and ask the agent to show candidate tasks before making edits. If you want higher assurance, ask the skill author for explicit authentication instructions and a signed release or use an official distribution channel.

Type: OpenClaw Skill Name: todoist-td Version: 0.1.1 The skill instructs the AI agent to install the Todoist CLI (`td`) by cloning its official GitHub repository and running `npm install` and `npm link`. While the `todoist-cli` is a legitimate tool and the installation steps are standard, this process involves downloading and executing code from an external source (github.com/Doist/todoist-cli), which introduces a supply chain risk. This capability, found in `SKILL.md`, is considered high-risk even without clear malicious intent, as it could be exploited if the upstream repository were compromised.