Ae1
High
- Category
- analysis-evasion
- Content
osascript -l JavaScript ./scripts/omnifocus.js <command> [args...]
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
OmniFocus Automation
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed OmniFocus automation tool, with task-changing powers users should use carefully.
Install only if you want Codex to read and change your OmniFocus data. Ask it to show matching task IDs before destructive actions, and require explicit confirmation before using delete because deleted tasks may be permanently removed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Vague Triggers
Medium
- Confidence
- 88% confidence
- Finding
- The skill description is broad enough to match many generic productivity or task-management requests, which can cause the agent to invoke this skill in situations where the user did not explicitly intend OmniFocus actions. Because the skill includes state-changing and destructive operations such as delete, move, and complete, over-broad activation increases the risk of unintended modifications to a real task database.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
| Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
- Confidence
- 80% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
| Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
- Confidence
- 80% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
| Command | Description | |---------|-------------| | `add <name> [project]` | Add task to inbox or project | | `newproject <name> [folder]` | Create project | | `newfolder <name>` | Create top-level folder | | `newtag <name>` | Create or get tag |
- Confidence
- 80% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Missing User Warnings
Medium
- Confidence
- 92% confidence
- Finding
- The command list exposes a permanent delete operation but does not clearly warn that it is destructive and irreversible. In an agentic context, this omission raises the chance of accidental task loss if the model maps a vague user request like 'remove' or 'clean up' to permanent deletion rather than a safer alternative.
Context-Inappropriate Capability
Medium
- Confidence
- 92% confidence
- Finding
- The script enables Standard Additions and invokes `doShellScript` to run dynamically constructed AppleScript via `osascript`, which expands its capability beyond direct OmniFocus automation into general subprocess execution. Although used here as a workaround for JXA limitations, this creates an unnecessary command-execution boundary where malformed escaping or future code changes could turn task/tag input into shell or AppleScript injection paths.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The `delete` command permanently removes a task immediately upon receiving a task ID, with no confirmation, dry-run mode, or safety interlock. In an agent-driven context, mistaken task selection, prompt confusion, or abuse by a downstream tool could cause silent destructive changes to a user's task data.
Missing User Warnings
Low
- Confidence
- 82% confidence
- Finding
- The helper `runAppleScript` invokes `doShellScript` to run `osascript`, which is subprocess execution. Although comments explain this is a workaround, there is no user-facing disclosure or warning when commands trigger shell execution.
Static analysis
No suspicious patterns detected.