Security audit

OmniFocus MCP for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent, but it deserves review because it runs an unpinned third-party OmniFocus server that can read, edit, and delete local task data.

Install only if you trust the upstream omnifocus-mcp npm package and are comfortable granting OpenClaw automation access to OmniFocus. Prefer read-only queries first, review bulk edits or removals carefully, and consider pinning a known-good package version before registering the MCP server.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Globally Installed Third-Party MCP Dependency
Content: View full analysis
/dev/null 2>&1; then echo "PASS: omnifocus-mcp found" else echo "WARN: omnifocus-mcp is not on PATH" echo "INFO: install it with npm install -g omnifocus-mcp" fi ``` `scripts/register_mcp.sh:9-14` ```bash if ! command -v omnifocus-mcp >/dev/null 2>&1; then echo "omnifocus-mcp is not installed or not on PATH" >&2 echo "Install it with: npm install -g omnifocus-mcp" >&2 exit 1 fi openclaw mcp set omnifocus '{"command":"omnifocus-mcp","args":[]}' ``` ### Technical Analysis The project instructs users and its package metadata to install `omnifocus-mcp` from npm without specifying an exact version or integrity digest. The global installation command resolves whichever package release and transitive dependency graph npm serves at installation time. After installation, `register_mcp.sh` registers the resulting PATH-resolved executable as an OpenClaw MCP server. This means the dependency is not merely a build-time component: it is launched as executable code and performs AppleScript-based operations against the user's OmniFocus database. The audited wrapper does not itself contain a malicious payload. The risk arises from trus ...[truncated 2187 chars]
Remediation: View remediation
``` 2. Ensure the metadata package specification uses the same exact version rather than an unconstrained package name. 3. Record and verify the expected npm integrity digest before installation. Where supported, distribute a lockfile or equivalent manifest containing exact transitive versions and integrity values. 4. Prefer a project-local, isolated dependency installation over a global installation. Register the executable using an absolute path inside the controlled installation directory rather than relying on ambient `PATH` resolution. 5. Disable unnecessary npm lifecycle scripts during installation when compatible with the upstream package: ```bash npm install --ignore-scripts --save-exact omnifocus-mcp@ ``` If lifecycle scripts are required, review them and document why they are necessary before enabling them. 6. Verify the selected version against the upstream GitHub release, npm provenance information, publisher identity, and published checksums before registration. 7. Add a setup check that validates the installed package version and resolved executable path. Refuse registration when the version differs from the approved version or when the executable resolves outside the expected directory. 8. Run the MCP server with the least privileges practical and restrict its access to only the resources needed for OmniFocus operations. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly advertises add, edit, remove, and batch operations against a live OmniFocus database but does not prominently warn that using the skill can modify or delete user task data. In a productivity skill, that omission increases the chance of accidental destructive actions, especially when invoked through natural language or note/transcript processing.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 101)May include surrounding context.
For example, if you want it available globally:

bash
mkdir -p ~/.openclaw/skills cp -R /Users/minhdoan/Documents/Codex/2026-04-18-can-you-refactor-this-into-a/omnifocus-mcp-skill ~/.openclaw/skills/omnifocus-mcp

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The default prompt encourages broad natural-language use such as reviewing due items, triaging the inbox, and creating or reorganizing tasks without stating clear boundaries or requiring explicit user confirmation for write actions. In a skill that can both read and modify OmniFocus data, this can cause over-broad or unintended invocation, increasing the chance of accidental task changes from loosely related user requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.