Skills ticktick-cli
📦

ticktick-cli

Content revision r2 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts⚙️ External commands

Manage TickTick Tasks from the Command Line

Managing TickTick data manually can interrupt automated workflows. This skill uses the official Open API to manage projects, tasks, focus records, and habits.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "ticktick-cli" from https://skillstore.io/skills/dcjanus-ticktick-cli.md and its manifest at https://skillstore.io/api/skills/dcjanus-ticktick-cli/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dcjanus-ticktick-cli.md Signed manifest GET /api/skills/dcjanus-ticktick-cli/manifest Signed lockfile GET /api/skills/dcjanus-ticktick-cli/lockfile

Test it

Using "ticktick-cli". List my projects without changing anything.

Expected outcome:

  • Work, identifier 64ab...
  • Personal, identifier 73cd...
  • Reading, identifier 91ef...

Using "ticktick-cli". Create a task called Submit expense report in Finance, due Friday, with two checklist items.

Expected outcome:

Created Submit expense report in Finance. Due Friday. Checklist: gather receipts; attach approval.

Using "ticktick-cli". Delete the old project.

Expected outcome:

Deletion can remove remote project data. Please identify the project and confirm that deletion is intended.

Security Audit

High Risk
v9 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, ordinary Python imports, error messages, official service URLs, and a plain-text Chinese document. The implementation has genuine risks from non-atomic token permissions, unpinned runtime dependencies, direct destructive commands, and disclosure of the local hostname during OAuth registration.

4
Files scanned
2,084
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (5)

High
scripts/ticktick_auth.py:404-409
OAuth Token Permissions Are Applied After Writing
The access token is written before chmod applies mode 0600. On multi-user systems, the process umask can briefly expose a tasks:read and tasks:write bearer token.
The code visibly calls write_text before chmod, so restrictive permissions are not established atomically.
Medium
scripts/ticktick_cli.py:1-9
Runtime Dependencies Are Not Reproducibly Pinned
The executable script requests dependencies with minimum versions only. Future invocations can install newer, unreviewed package releases and execute their installation or runtime code.
The uv script metadata contains four greater-than-or-equal dependency constraints and no reviewed exact versions.
Medium
SKILL.md:21scripts/ticktick_cli.py:507-514scripts/ticktick_cli.py:662-670
Destructive Commands Lack Programmatic Confirmation
Project and task delete commands immediately call the remote deletion API. The skill asks the agent to confirm intent, but the CLI does not enforce that safeguard.
The documented confirmation rule is clear, while both command handlers delete immediately without a prompt or force option.
Low
scripts/ticktick_auth.py:177
System reconnaissance
hostname = socket.gethostname().strip().split(".")[0]
The code reads the local hostname and later includes it in the dynamically registered OAuth client name. This unnecessarily discloses a device identifier to the selected service.
Low
scripts/ticktick_auth.py:180
System reconnaissance
return f"ticktick-cli ({hostname}, {today})"
The return value embeds the hostname and date in the client name used by OAuth dynamic registration. A generic name would avoid this low-severity privacy disclosure.

Risk Factors

🌐 Network access (15)
scripts/ticktick_api_client.py:322 scripts/ticktick_api_client.py:330 scripts/ticktick_api_client.py:347 scripts/ticktick_api_client.py:8 scripts/ticktick_auth.py:374 scripts/ticktick_auth.py:12 scripts/ticktick_auth.py:137 scripts/ticktick_auth.py:148 scripts/ticktick_auth.py:50 scripts/ticktick_auth.py:51 scripts/ticktick_auth.py:345 scripts/ticktick_auth.py:342 scripts/ticktick_auth.py:345 scripts/ticktick_cli.py:82 SKILL.md:86
📁 Filesystem access (3)
scripts/ticktick_auth.py:163 SKILL.md:43 SKILL.md:43
🔑 Env variables (2)
scripts/ticktick_auth.py:37 scripts/ticktick_auth.py:40
⚡ Contains scripts (2)
scripts/ticktick_cli.py:32-44 scripts/ticktick_cli.py:45-53
⚙️ External commands (27)
scripts/ticktick_cli.py:97 scripts/ticktick_cli.py:384 SKILL.md:14-17 SKILL.md:17-19 SKILL.md:19 SKILL.md:20-21 SKILL.md:21-22 SKILL.md:22-26 SKILL.md:26-30 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-38 SKILL.md:38-40 SKILL.md:40-41 SKILL.md:41-43 SKILL.md:43 SKILL.md:51-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-59 SKILL.md:59-64 SKILL.md:64-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70-71 SKILL.md:71

Detected Patterns

System reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/dcjanus-ticktick-cli/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dcjanus-ticktick-cli/security.svg)](https://skillstore.io/skills/dcjanus-ticktick-cli?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dcjanus-ticktick-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dcjanus-ticktick-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dcjanus-ticktick-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

DCjanus. (2026). ticktick-cli security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dcjanus-ticktick-cli/audits/9

BibTeX citation

@techreport{dcjanus-dcjanus-ticktick-cli-2026, author = {DCjanus}, title = {ticktick-cli security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/dcjanus-ticktick-cli/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "ticktick-cli security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "DCjanus" date-released: "2026-07-23" url: "https://skillstore.io/skills/dcjanus-ticktick-cli/audits/9" identifiers: - type: other value: "skillstore:dcjanus-ticktick-cli:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Maintain a Personal Task Queue

Review active tasks, add due dates, complete finished work, and move tasks between projects.

Automate Project Intake

Create projects and structured tasks from an approved workflow while preserving tags, priorities, and checklist items.

Analyze Productivity Records

Retrieve focus sessions, completed tasks, habits, and check-ins for a selected reporting period.

Try These Prompts

List My Projects 
List my TickTick projects. Return each project name and identifier. Do not change any data.
Create a Structured Task 
Create a task named [title] in project [project]. Set due date [date], priority [priority], tags [tags], and checklist [items].
Review and Reorganize Work 
Find incomplete tasks in project [source] with tag [tag]. Propose moves to project [destination], then wait for my approval before changing anything.
Build a Productivity Summary 
For [date range], compare completed tasks, focus sessions, and habit check-ins. Group results by project and highlight missing or inconsistent records.

Best Practices

  • Use read-only list or get commands to verify identifiers before remote changes.
  • Request JSON output when another tool or agent must parse the result.
  • Confirm the exact target before every delete, move, complete, or bulk update operation.

Avoid

  • Do not expose, print, or share the local OAuth token file.
  • Do not infer a project or task identifier from a similar display name.
  • Do not execute destructive operations from an ambiguous or indirect request.

Frequently Asked Questions

Which services does this skill support?
It supports Dida365 in China and the international TickTick service through their Open API endpoints.
How does authentication work?
The CLI uses OAuth with PKCE, dynamic client registration, and a loopback callback on 127.0.0.1.
Where is the token stored?
The default path is ~/.config/ticktick-cli/token.json. TICKTICK_TOKEN_FILE can select another path.
Can it manage checklist items and tags?
Yes. Task create and update commands accept repeated items, structured item payloads, and repeated tags.
Does it confirm deletions automatically?
No. The agent must obtain clear user confirmation before running project, task, or focus deletion.
What is required to run the CLI?
The script declares uv execution, Python 3.14 or newer, four Python packages, network access, and a supported account.

Developer Details

Author

DCjanus

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/DCjanus/prompts/tree/master/skills/ticktick-cli

Ref

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

Maintenance freshness

7/25/2026

Usage

10 downloads · 255 views

File structure

📁 scripts/

📄 ticktick_api_client.py

📄 ticktick_auth.py

📄 ticktick_cli.py

📄 SKILL.md