Todoist Sync API Task Orchestrator

SUSPICIOUS: the core purpose is legitimate Todoist orchestration, and the official MCP endpoint appears to be genuinely operated by Todoist, but the skill’s install path relies on an unpinned third-party `mcp-remote` package that handles Todoist OAuth tokens before forwarding requests. This is internally plausible yet higher-risk than a first-party installation path, so the main issue is supply-chain and credential-forwarding trust rather than confirmed malware.