The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the local OmniFocus SQLite database which contains private user information including tasks, notes, and project details.
Evidence: scripts/sqlite_reader.rb reads files from sensitive paths like ~/Library/Caches/com.omnigroup.OmniFocus/OmniFocusDatabase2 and application containers.
[COMMAND_EXECUTION]: The skill uses osascript to execute dynamically constructed AppleScript and JavaScript (JXA) strings to automate the OmniFocus application.
Evidence: scripts/applescript_client.rb and scripts/omni_automation.rb generate script strings incorporating user-provided data and execute them via system shell backticks.
[PROMPT_INJECTION]: The skill is exposed to indirect prompt injection as it ingests and processes untrusted content from the user's OmniFocus database.
Ingestion points: Task names, notes, and project descriptions retrieved from the local database in scripts/omnifocus_manager.rb.
Boundary markers: While the output is formatted as JSON, the individual text fields do not include delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has the capability to modify the local database, create new tasks, and execute shell commands through the Ruby environment.
Sanitization: The code uses Shellwords.escape to prevent shell injection but does not filter for malicious natural language instructions within the retrieved data.

omnifocus