ticktick-official-cli

使用官方 Dida365 OAuth 与 Open API 管理滴答清单（项目/任务查询、创建、更新、完成、删除）。当用户要求安全地直连 dida365.com（不经过第三方 OAuth 中转）时使用。

This skill appears to be what it claims: a local CLI that uses Dida365's OAuth and Open API. Before installing or running it, consider: 1) the skill will prompt you to provide a Dida365 client_id and client_secret and may save them (app.env) and an access token (token.env) under ~/.config/ticktick-official/ — review or remove those files if you stop using the skill; 2) the registry metadata did not declare the env vars or token file locations even though the scripts use them — treat this as a documentation/metadata omission and confirm you supply credentials only to the official developer console (https://developer.dida365.com) and that the authorization URLs are dida365.com/api.dida365.com; 3) the skill launches a local HTTP listener to receive the OAuth callback (localhost/127.0.0.1) — ensure that port is acceptable and not blocked; 4) if you do not trust the source, inspect the bundled scripts yourself (they are included) before running. If you want higher assurance, verify the code signatures or obtain the tool from an official upstream repository.

Type: OpenClaw Skill Name: ticktick-official-cli Version: 1.0.1 The skill is generally benign, providing legitimate integration with the Dida365 API. However, a significant prompt injection vulnerability exists in `scripts/ticktick_cli.py`. The `--item-json @path` option in `task create` and `task update` commands allows reading arbitrary local files (e.g., `@/etc/passwd`, `@~/.ssh/id_rsa`). A maliciously prompted AI agent could be instructed to read sensitive files and exfiltrate their content by including it in a task's checklist items, which are then sent to the Dida365 API. This constitutes a local file inclusion leading to data exfiltration via prompt injection.