Wecomcli Todo Skill Security Audit

The documentation shows JSON inside single quotes and derives titles from user messages, but it does not include the executor or explain how the placeholder is passed. Directly interpolating user text containing a single quote into a shell string could enable command injection; an argument array or reliable escaping would prevent it. Users can ask the author to document parameter handling and restrict the agent from shell-concatenating user content.

Creation can add people to the assignee list, while the skill treats merely saying a task is “about” or “related to” someone as sufficient to add them. This could expose the task title, description, or association to that person and assign work without clear authorization. Users can restrict additions to explicit wording such as “assign/invite/share responsibility,” requiring confirmation otherwise.

The update flow explicitly permits sourcing participants, times, links, and reference numbers from the conversation, task details, and available chat or memory retrieval, then updating whenever the model considers the data certain. This could place sensitive links, associations, or identifiers from another context into a corporate task without item-by-item confirmation. Users can require source restrictions and a preview plus approval before such data is written.

The skill allows a creator to mark every participant complete with `finished_all=true`, and classifies the common phrase “完成了” as an explicit request for that action. A creator's ambiguous statement that may only mean their own work is done could therefore change other participants' status without confirmation. Users can ask that this value be used only when “all/every participant” is explicit, with confirmation otherwise.

The documentation explicitly says that setting only a deadline still uses the backend's default advance reminder, and the API has no “disable reminder” input. A user who only asked to record a due date may therefore receive an unrequested notification. Users can require the agent to disclose this effect before setting a deadline; if silence is essential, omit the deadline or verify available reminder controls in WeCom.