Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md osascript -l JavaScript ./scripts/omnifocus.js <command> [args...]
Security audit
OmniFocus Automation
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed OmniFocus automation tool, with task-changing powers users should use carefully.
Install only if you want Codex to read and change your OmniFocus data. Ask it to show matching task IDs before destructive actions, and require explicit confirmation before using delete because deleted tasks may be permanently removed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is broad enough to match many generic productivity or task-management requests, which can cause the agent to invoke this skill in situations where the user did not explicitly intend OmniFocus actions. Because the skill includes state-changing and destructive operations such as delete, move, and complete, over-broad activation increases the risk of unintended modifications to a real task database.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The command list exposes a permanent delete operation but does not clearly warn that it is destructive and irreversible. In an agentic context, this omission raises the chance of accidental task loss if the model maps a vague user request like 'remove' or 'clean up' to permanent deletion rather than a safer alternative.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script enables Standard Additions and invokes
doShellScriptto run dynamically constructed AppleScript viaosascript, which expands its capability beyond direct OmniFocus automation into general subprocess execution. Although used here as a workaround for JXA limitations, this creates an unnecessary command-execution boundary where malformed escaping or future code changes could turn task/tag input into shell or AppleScript injection paths.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The
deletecommand permanently removes a task immediately upon receiving a task ID, with no confirmation, dry-run mode, or safety interlock. In an agent-driven context, mistaken task selection, prompt confusion, or abuse by a downstream tool could cause silent destructive changes to a user's task data.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The helper
runAppleScriptinvokesdoShellScriptto runosascript, which is subprocess execution. Although comments explain this is a workaround, there is no user-facing disclosure or warning when commands trigger shell execution.- Content
Static analysis
No suspicious patterns detected.