Todozi - Your Ai Task Manager

Todozi Eisenhower matrix API client + LangChain tools. Create matrices, tasks, goals, notes; list/search/update; bulk operations; webhooks. Categories: do, done, dream, delegate, defer, dont.

This skill's code and docs match the stated purpose (a Todozi API client and LangChain tools), but the registry metadata is incomplete: it doesn't declare the TODOZI_API_KEY (and dependency list) that the SKILL.md and code expect. Before installing, verify the source/trustworthiness of todozi.com and the skill author. Do not supply real API keys unless you trust the service; consider creating a limited/test API key. Be careful when registering webhooks — any webhook URL you provide will receive event payloads (potentially exposing task data). Ask the publisher to update the registry metadata to list required env vars (TODOZI_API_KEY, TODOZI_BASE optional) and Python dependencies (e.g., httpx, langchain, langgraph). If you proceed, run the skill in a restricted environment or review the full code for any additional network calls and audit webhook targets.

Type: OpenClaw Skill Name: todozi Version: 1.0.0 The skill bundle is classified as suspicious due to the presence of webhook creation functionality (`create_webhook` and `register` methods in `scripts/todozi.py`, documented in `SKILL.md` and `references/api_reference.md`). These methods allow the skill to send data (webhook events, including potentially sensitive item details or newly registered API keys) to an arbitrary, user-defined URL. While this is a legitimate API feature, it presents a significant risk for data exfiltration if the AI agent is compromised via prompt injection, as it could be instructed to send data to an attacker-controlled endpoint. The `register` function also returns a `private_key` which could be exfiltrated.