todoist-automation
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as task content, descriptions, and filter queries which are passed to Todoist API tools without boundary markers or sanitization.
- Ingestion points: Task titles and descriptions used in TODOIST_CREATE_TASK and TODOIST_BULK_CREATE_TASKS as described in SKILL.md.
- Boundary markers: Absent; the instructions do not include delimiters or specific guidance for the agent to ignore instructions embedded in the task data.
- Capability inventory: The skill utilizes tools with the ability to create, modify, and delete tasks, sections, and projects (e.g., TODOIST_CREATE_TASK, TODOIST_DELETE_TASK).
- Sanitization: No validation or filtering of input data is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill setup requires the user to add an external MCP server endpoint (https://rube.app/mcp). This involves trusting a non-standard third-party infrastructure to define and execute agent tools.
Audit Metadata