todoist latest

Manage Todoist tasks. Use when the user mentions "todoist", "my tasks", "task list", "add a task", "complete task", or wants to interact with their Todoist account.

This skill is coherent (it delegates Todoist work to the 'td' CLI) but has two practical concerns: (1) it does not declare how the Todoist API token or local config are provided or where they are stored — the 'td' binary will need credentials and will read/write a local cache, so inspect how 'td' authenticates (env vars, ~/.config, etc.) before use; (2) the Homebrew formula comes from a third‑party tap (LuoAndOrder) rather than core Homebrew — review the tap/formula and the upstream repo for trustworthiness. Recommendations: (a) review the 'td' project's README to learn where it stores credentials and whether it uses plaintext tokens; (b) verify the Homebrew formula or build from source if you don’t trust the tap; (c) limit the Todoist API token's scope if possible and store it securely (use a dedicated token); (d) consider running the CLI in an isolated environment (container) until you confirm its behavior. If you want, I can fetch the repo/homepage and point out where the CLI stores config and how to inspect the Homebrew formula before installing.

Type: OpenClaw Skill Name: todoist-rs Version: 1.0.1 The skill provides a straightforward integration with Todoist via the `td` command-line interface. All instructions and commands in `SKILL.md` are directly related to managing Todoist tasks, projects, and labels. The installation method is explicitly declared using Homebrew (`LuoAndOrder/tap/todoist-cli`), which is a standard package manager. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. The behavior is clearly aligned with the stated purpose of managing Todoist tasks.