ClawHub
Back to skill

Security audit

things-mac

Security checks for vulnerabilities and agentic risk

Overview

This Things 3 helper is mostly purpose-aligned, but it asks users to grant very broad local disk access and install an unpinned third-party CLI.

Install only if you are comfortable with a third-party CLI controlling your Things tasks. Prefer pinning or reviewing the CLI version, use `THINGS_AUTH_TOKEN` instead of putting tokens in commands, and avoid granting Full Disk Access to OpenClaw.app or Terminal unless you understand that it exposes much more than Things data and revoke it afterward.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding
Unpinned Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17 and 32 **Vulnerability Type**: Unpinned and mutable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml "module": "github.com/ossianhempel/things3-cli/cmd/things@latest", ``` ```markdown - Install (recommended, Apple Silicon): `GOBIN=/opt/homebrew/bin go install github.com/ossianhempel/things3-cli/cmd/things@latest` ``` ### Technical Analysis The installation instructions retrieve and compile the `things3-cli` dependency using the mutable `@latest` version selector. Consequently, the code installed in the future may differ from the version that was available when this Skill was reviewed. Although the dependency path is consistent with the declared project homepage, the Skill does not pin a reviewed release or commit and does not require checksum or signature verification. A compromised upstream repository, maintainer account, Go module distribution path, or future malicious release could therefore cause attacker-controlled code to be installed and executed. This is a supply-chain weakness rather than evidence that the current upstream project is malicious. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release process, or module distribution channel. 2. The attacker publishes a malicious version that becomes the version resolved by `@latest`. 3. A user follows the documented installation command or the Skill framework processes the installation metadata. 4. Go retrieves and builds the attacker-controlled source. 5. The resulting `things` executable runs with the privileges of the invoking user. 6. The executable can access data and resources available to that user, potentially including additional protected data if Full Disk Access has also been granted. ### Impact Assessment Successful exploitation permits arbitrary native-code execution with the privileges of the user installing or invoking the CLI. This may exp ...[truncated 249 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace `@latest` with a specific reviewed semantic version or immutable commit identifier. - Document the expected version in both installation metadata and user-facing setup instructions. - Verify release checksums or cryptographic signatures before installation where supported. - Use a dependency update process that reviews upstream changes before changing the pinned version. - Consider distributing a reproducibly built and signed binary from a trusted release process. - Avoid automatically upgrading the dependency without explicit user approval and security review. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:33
Finding
Excessive Full Disk Access Recommendation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 33 **Vulnerability Type**: Overbroad macOS privacy permission **Risk Level**: High ### Vulnerable Code ```markdown - If DB reads fail: grant **Full Disk Access** to the calling app (Terminal for manual runs; `OpenClaw.app` for gateway runs). ``` ### Technical Analysis The Skill recommends granting Full Disk Access to Terminal or the entire `OpenClaw.app` host when Things database reads fail. Full Disk Access is substantially broader than access to a Things database and weakens macOS privacy boundaries for the entire authorized application. Granting this permission to a general-purpose agent host is particularly sensitive because the permission applies to the host process and potentially to tools or Skills that it launches. The recommendation therefore expands the accessible data beyond what is required to manage Things tasks. The reviewed file does not itself contain instructions to misuse this access. The vulnerability is the excessive permission scope and the resulting increase in impact if the host, another loaded component, or the installed CLI is compromised. ### Attack Path 1. A user encounters a Things database access failure. 2. Following the Skill instructions, the user grants Full Disk Access to Terminal or `OpenClaw.app`. 3. The authorized host subsequently runs the `things` CLI, another Skill, plugin code, or a compromised dependency. 4. Malicious code operating within the authorized process context accesses protected files unrelated to Things. 5. The data may be collected, modified, or disclosed according to the permissions available to the host process. ### Impact Assessment The permission may expose protected data belonging to other applications and system locations that macOS would ordinarily restrict. Depending on the user's environment, this could include messages, mail, browser data, application databases, backups, and other sensitive local files. The recommend ...[truncated 196 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not recommend Full Disk Access as the default solution for database access failures. - Use a narrowly scoped helper process dedicated to reading the Things database rather than granting the permission to the entire agent host. - Prefer an official Things API, controlled export mechanism, or user-selected database path where possible. - If Full Disk Access is unavoidable, clearly explain its broad scope and require explicit informed user approval. - Advise users to revoke the permission after completing the operation. - Isolate database-reading functionality from unrelated Skills and tools. - Validate that the requested database path belongs to Things before reading it. - Avoid combining this permission with automatically installed or unpinned executables. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:59
Finding
Authentication Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–66 **Vulnerability Type**: Sensitive credential passed through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```markdown - First: get the ID (UUID column): `things search "milk" --limit 5` - Auth: set `THINGS_AUTH_TOKEN` or pass `--auth-token <TOKEN>` - Title: `things update --id <UUID> --auth-token <TOKEN> "New title"` - Notes replace: `things update --id <UUID> --auth-token <TOKEN> --notes "New notes"` - Notes append/prepend: `things update --id <UUID> --auth-token <TOKEN> --append-notes "..."` / `--prepend-notes "..."` - Move lists: `things update --id <UUID> --auth-token <TOKEN> --list "Travel" --heading "Before"` - Tags replace/add: `things update --id <UUID> --auth-token <TOKEN> --tags "a,b"` / `things update --id <UUID> --auth-token <TOKEN> --add-tags "a,b"` - Complete/cancel (soft-delete-ish): `things update --id <UUID> --auth-token <TOKEN> --completed` / `--canceled` ``` ### Technical Analysis The examples repeatedly place the Things authentication token directly in the command-line argument list. Secrets supplied this way may be retained in shell history, terminal logs, agent execution traces, process-monitoring records, debugging output, or telemetry. Depending on operating-system controls, command arguments may also be observable by other local processes or users while the command is running. The document mentions `THINGS_AUTH_TOKEN` as an alternative, but the majority of update examples normalize the less secure command-line pattern. Environment variables are not universally secret either, but protected environment injection avoids routine shell-history exposure and is preferable to literal token arguments. ### Attack Path 1. A user replaces `<TOKEN>` with a real authentication token in one of the documented commands. 2. The shell, terminal, agent framework, process monitor, or logging system records the complete command. 3. An attacker or unautho ...[truncated 800 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove all examples that place authentication tokens directly in command-line arguments. - Make protected `THINGS_AUTH_TOKEN` injection the documented default. - Prefer storage in macOS Keychain and retrieve the credential only when needed. - If supported by the CLI, accept the token through standard input or a protected file descriptor. - Ensure secret values are redacted from application logs, command previews, error messages, telemetry, and dry-run output. - Warn users not to paste tokens into shell commands or commit them to scripts and configuration files. - Apply restrictive permissions to any configuration file containing credentials. - Rotate the token if it has previously appeared in shell history or logs. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.