The Agent Skills Directory

[METADATA_POISONING]: The skill metadata contains a verification: "security_reviewed" field. This is a self-reported claim of safety that should not be treated as an authoritative security guarantee.
[METADATA_POISONING]: The frontmatter identifies the author as "Doist" (the creator of Todoist), which conflicts with the skill's distribution source. This discrepancy may lead users to believe the skill is an official integration when it may not be.
[INDIRECT_PROMPT_INJECTION]: The skill orchestrates workflows by reading and writing task data, which is a common vector for indirect prompt injection.
Ingestion points: Task descriptions, project names, and labels fetched via the Todoist Sync API as described in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to prevent the agent from obeying commands embedded within the task data.
Capability inventory: The skill performs atomic batch operations on items, projects, and labels, allowing for significant modification of account data (SKILL.md).
Sanitization: There is no evidence of filtering or sanitizing the data retrieved from the API before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The installation instructions include running a remote Model Context Protocol (MCP) server from https://ai.todoist.net/mcp using npx. This domain is associated with the Todoist service.

Todoist Sync API Task Orchestrator