Ticktick

Manage TickTick tasks and projects

What to consider before installing: - Runtime requirement: The code and SKILL.md assume the 'bun' runtime (shebangs and 'bun run' commands). The registry lists no required binaries. If you don't have Bun, the skill will likely fail or require manual setup. Confirm whether you are comfortable installing Bun or adjusting the skill to use your environment. - Credentials & storage: You will need to provide a TickTick OAuth client_id and client_secret during initial setup. These are stored under ~/.clawdbot/credentials/ticktick-cli/config.json (file permissions are set to be restrictive). Ensure you trust the skill author before storing OAuth credentials locally. - Metadata mismatch: The embedded _meta.json ownerId differs from the registry Owner ID. This could be an innocuous packaging oversight, but it's worth verifying the publisher/source before granting access to your TickTick account. - Dependencies & install: The repository includes package.json and package-lock.json (many npm deps). There is no install spec, so you may need to manually install dependencies or ensure Bun supports running the TypeScript files as-is. Manual installation increases risk of mistakes — prefer a skill that documents required runtime and install steps. - Local OAuth server: The skill spins up a temporary localhost server to complete OAuth. This is normal for CLI OAuth flows, but be aware it listens on 127.0.0.1:8080 during auth and will open a browser. Ensure you only accept the OAuth redirect you initiated. - Review before running: If you are not comfortable with the small inconsistencies above, ask the publisher for clarification or request a version that declares 'bun' as a required binary and confirms the ownerId/source. If you proceed, inspect the files locally (especially scripts/auth.ts and where credentials are saved) and consider running inside a controlled environment (container) first.

Type: OpenClaw Skill Name: ticktick-enhanced Version: 0.2.0 The skill bundle contains a critical shell injection vulnerability in `index.ts`, where user-provided arguments are concatenated into a command string and executed via `Bun.spawnSync` without sanitization. While the skill's logic for managing TickTick tasks via OAuth2 and the official API (`https://api.ticktick.com`) appears legitimate and well-structured, this implementation flaw allows for arbitrary command execution. The skill also handles sensitive credentials stored in `~/.clawdbot/credentials/ticktick-cli/`, which increases the impact of the execution vulnerability.