dida365
Warn
Audited by Snyk on Mar 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's CLI code (tt.py) calls the external Dida365/TickTick API at https://api.dida365.com/open/v1 (see _get("/project") and _get(f"/project/{project_id}/data") in tt.py and the SKILL.md usage), ingesting user-generated projects/tasks which the agent reads and uses to choose actions (list/complete/update/delete), so untrusted third-party content can influence behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata