Security audit

things-mac

Security checks for vulnerabilities and agentic risk

Overview

This Things 3 helper is mostly purpose-aligned, but it asks users to grant very broad local disk access and install an unpinned third-party CLI.

Install only if you are comfortable with a third-party CLI controlling your Things tasks. Prefer pinning or reviewing the CLI version, use `THINGS_AUTH_TOKEN` instead of putting tokens in commands, and avoid granting Full Disk Access to OpenClaw.app or Terminal unless you understand that it exposes much more than Things data and revoke it afterward.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Third-Party CLI Installation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:33
Finding: Excessive Full Disk Access Recommendation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:59
Finding: Authentication Token Exposure Through Command-Line Arguments
Content: View full analysis
` - Title: `things update --id --auth-token "New title"` - Notes replace: `things update --id --auth-token --notes "New notes"` - Notes append/prepend: `things update --id --auth-token --append-notes "..."` / `--prepend-notes "..."` - Move lists: `things update --id --auth-token --list "Travel" --heading "Before"` - Tags replace/add: `things update --id --auth-token --tags "a,b"` / `things update --id --auth-token --add-tags "a,b"` - Complete/cancel (soft-delete-ish): `things update --id --auth-token --completed` / `--canceled` ``` ### Technical Analysis The examples repeatedly place the Things authentication token directly in the command-line argument list. Secrets supplied this way may be retained in shell history, terminal logs, agent execution traces, process-monitoring records, debugging output, or telemetry. Depending on operating-system controls, command arguments may also be observable by other local processes or users while the command is running. The document mentions `THINGS_AUTH_TOKEN` as an alternative, but the majority of update examples normalize the less secure command-line pattern. Environment variables are not universally secret either, but protected environment injection avoids routine shell-history exposure and is preferable to literal token arguments. ### Attack Path 1. A user replaces `` with a real authentication token in one of the documented commands. 2. The shell, terminal, agent framework, process monitor, or logging system records the complete command. 3. An attacker or unautho ...[truncated 800 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.