Security audit

Omnifocus4

Security checks across malware telemetry and agentic risk

Overview

This OmniFocus skill appears purpose-built rather than malicious, but it grants broad live read/write/delete access to a personal task database with under-scoped safety guidance.

Install only if you intentionally want an agent to access your live OmniFocus database. Keep write authorization in once or every mode, avoid yolo, require explicit confirmation before delete or bulk edits, and verify the missing scripts/of entrypoint or call the reviewed Python script directly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes shell execution and state-changing capabilities but does not declare permissions or clearly bound them. This undermines least privilege and makes it easier for the agent to invoke powerful operations without an explicit trust/consent boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The public description suggests routine querying and common task actions, but the documented behavior includes broad destructive and administrative actions such as delete, move, rename, note replacement, recurrence changes, and local preference storage. This mismatch can mislead users and orchestrators into granting or invoking the skill in situations where they do not expect high-impact modifications.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation language is extremely broad and targets common task-related requests, increasing the chance the skill is auto-selected for benign planning prompts. Because the skill includes write and delete operations, overbroad routing can cause unnecessary exposure of private data or accidental state changes in a live task database.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill documents destructive and modifying commands, including permanent deletion and note replacement, without any confirmation, preview, or rollback guidance. In a live personal productivity system, accidental execution can irreversibly alter or remove user data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The instruction to always run live commands for task-related requests encourages immediate data access without warning about privacy, scope, or environment suitability. This increases the risk of exposing sensitive task contents or performing access in contexts where the user did not intend live personal data retrieval.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill includes destructive write operations against a live OmniFocus database and allows all authorization checks to be bypassed by setting prefs mode to 'yolo'. In an agent setting, this weakens the only safety barrier preventing unintended task creation, deletion, completion, or modification, making prompt-induced or accidental destructive actions much easier.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.