by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This is a lightweight, coherent curl/jq wrapper for the Todoist API. Before installing: 1) Only provide a Todoist API token you intend to allow this skill to use — tokens grant full API access for that account. Consider creating a separate account/token if you want isolation. 2) Confirm whether you are comfortable with the skill reading a local token file (~/.openclaw/.secrets/todoist_token.json) — if not, keep the token only in the environment and ensure file permissions. 3) Because the skill c...详细分析 ▾
✓ 用途与能力
Name/description match the declared requirements: curl, jq, and TODOIST_API_TOKEN are exactly what a curl-based Todoist integration needs. No unrelated services, binaries, or excessive capabilities are requested.
ℹ 指令范围
The SKILL.md only instructs the agent to call official Todoist endpoints (rest/v2 and legacy api/v1) using the TODOIST_API_TOKEN in Authorization headers and to pipe results through jq. That stays within the stated purpose. Note: the docs mention an alternate token location (~/.openclaw/.secrets/todoist_token.json) which the skill may read for credentials even though no config paths were declared—this is a minor scope expansion worth noting.
✓ 安装机制
Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by an installer. This is low-risk from an install mechanism perspective.
ℹ 凭证需求
The only required environment variable is TODOIST_API_TOKEN, which is appropriate for the purpose. However, SKILL.md references an alternate local secrets file path (~/.openclaw/.secrets/todoist_token.json) that is not declared under required config paths; that creates a small mismatch between declared requirements and runtime behavior. Also remember that possession of the API token grants the skill the same API access as your account (create/modify/view tasks).
✓ 持久化与权限
always is false and the skill has no install or persistence actions. It does not request elevated or cross-skill configuration access.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/4
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install todoist-api-rest
镜像加速npx clawhub@latest install todoist-api-rest --registry https://cn.longxiaskill.com