Chen Things Mac

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:53 PM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for managing Things 3, but it asks users to install mutable third-party code and may require broad macOS Full Disk Access.

Install only if you are comfortable trusting the upstream things3-cli project at install time. Prefer a pinned reviewed version instead of @latest, try a specific THINGSDB path before granting broader permissions, and avoid giving Full Disk Access to Terminal or Clawdbot.app unless you understand that other commands run through that app may gain access to protected local data too.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 13 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"✅","os":["darwin"],"requires":{"bins":["things"]},"install":[{"id":"go","kind":"go","module":"github.com/ossianhempel/things3-cli/cmd/things@latest","bins":["things"],"label":"Install things3-cli (go)"}]}} ``` ```text - Install (recommended, Apple Silicon): `GOBIN=/opt/homebrew/bin go install github.com/ossianhempel/things3-cli/cmd/things@latest` ``` ### Technical Analysis The installation configuration and documentation use the mutable Go version selector `@latest`. Consequently, the source code installed by this Skill can change after the Skill has been reviewed, without any corresponding modification to the package itself. This creates a supply-chain trust boundary around the upstream repository, its maintainers, release process, and transitive dependencies. If a future release is compromised or malicious, the installation command can produce an attacker-controlled `things` executable. The resulting binary is then invoked to access the local Things database and perform task-management operations. No evidence was found that the currently referenced upstream project is malicious. The risk arises from accepting an unpinned future version rather than an immutable, reviewed release. ### Attack Path 1. An attacker compromises the upstream module repository, a maintainer account, or its release process. 2. The attacker publishes a malicious version that becomes the version selected by `@latest`. 3. A user or Agent follows the Skill installation instructions. 4. `go install` resolves and builds the attacker-controlled release. 5. The installed `things` executable is subsequently invoked for a legitimate-looking Skill operation. 6. The executable runs with the permissions of the invoking user or host appli ...[truncated 654 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with a reviewed, explicit release version or immutable commit identifier in both the metadata and installation documentation. - Keep the metadata installation target and documented command synchronized. - Verify the resolved Go module and transitive dependency checksums through the standard Go checksum database or an organization-controlled verification process. - Record the expected source revision and binary provenance in release documentation. - Establish a controlled dependency-update process that includes source review, changelog review, testing, and security scanning before changing the pinned version. - Where practical, distribute a signed release artifact and verify its signature or cryptographic digest before installation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14
• Finding: Overbroad Full Disk Access Recommendation## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable Code Snippet**: ```text - If DB reads fail: grant **Full Disk Access** to the calling app (Terminal for manual runs; `Clawdbot.app` for gateway runs). ``` ### Technical Analysis The Skill recommends granting macOS Full Disk Access to the calling application when database reads fail. This permission is substantially broader than access to the Things database alone and weakens least-privilege isolation. Granting this permission to a general-purpose terminal or Agent host extends the permission boundary beyond this individual Skill. Other commands, dependencies, plugins, or Agent operations running through the authorized application may consequently be able to access protected user data unrelated to Things. The instruction does not itself bypass macOS authorization: the user must approve the permission through the operating system. Nevertheless, it encourages a broad and persistent permission grant without documenting its wider scope, alternatives, or a revocation procedure. ### Attack Path 1. A Things database read fails because macOS denies access. 2. The user follows the Skill guidance and grants Full Disk Access to Terminal or `Clawdbot.app`. 3. The authorization remains associated with that general-purpose calling application. 4. A compromised dependency, malicious command, unsafe plugin, or abused Agent operation executes through the authorized application. 5. The executing process attempts to read protected files outside the Things data directory. 6. The broad authorization may permit access that would otherwise have been blocked by macOS privacy controls. ### Impact Assessment The permission may expose protected data outside the declared Things-management scope, potentially including application databases, messages, mail, browser infor ...[truncated 447 chars]
• Remediation: ## Remediation Suggestions - Avoid presenting Full Disk Access as the default response to a failed database read. - Prefer the narrowest available authorization or a user-selected Things data directory. - Explain what Full Disk Access exposes and require explicit, informed user confirmation before recommending it. - Distinguish between permission failures and unrelated configuration errors before suggesting elevated access. - Recommend granting access only to a dedicated, minimally privileged execution host rather than a general-purpose terminal or Agent application. - Document how to revoke Full Disk Access immediately after the operation if continuing access is unnecessary. - Warn that every command or component executed through the authorized application may inherit or benefit from the expanded access boundary.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: chen-things-mac
description: Manage Things 3 via the `things` CLI on macOS (add/update projects+todos via URL scheme; read/search/list from the local Things database). Use when a user asks Clawdbot to add a task to Things, list inbox/today/upcoming, search tasks, or inspect projects/areas/tags.
homepage: https://github.com/ossianhempel/things3-cli
metadata: {"clawdbot":{"emoji":"✅","os":["darwin"],"requires":{"bins":["things"]},"install":[{"id":"go","kind":"go","module":"github.com/ossianhempel/things3-cli/cmd/things@latest","bins":["things"],"label":"Install things3-cli (go)"}]}}
---

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.