The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically installs the things CLI from a third-party GitHub repository (github.com/ossianhempel/things3-cli) using the go install command, introducing unverified external code into the execution environment.
[COMMAND_EXECUTION]: It relies on shell command execution via the things binary to manage tasks. It also instructs users to grant 'Full Disk Access' to the application, which is a significant privilege escalation on macOS required to read the local SQLite database.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads user-controlled data (task titles, notes, and project names) from the local database. This content could contain malicious instructions that the agent might follow in subsequent steps.
Ingestion points: Data enters the context via things inbox, things today, and things search commands in SKILL.md.
Boundary markers: No delimiters or instructions to ignore embedded commands are present when data is fetched.
Capability inventory: The agent has the ability to execute system commands via the things CLI.
Sanitization: There is no evidence of validation or sanitization of the fetched database content before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The skill uses a THINGS_AUTH_TOKEN for write operations. The instructions suggest that this token can be passed as a command-line argument (--auth-token), which can lead to credential exposure in system process logs or history.

things-mac