MH things-mac

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill does what it says for Things 3, but it asks users to install an unpinned third-party CLI and may require broad Full Disk Access for OpenClaw or Terminal.

Install only if you are comfortable with the third-party things3-cli dependency and the Things data it can read or modify. Prefer a pinned reviewed version instead of @latest, use dry-run for writes, avoid putting auth tokens in command history, and grant Full Disk Access only if necessary and remove it afterward.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17 and 32
Vulnerability Type: Supply-chain risk from a mutable dependency version
Risk Level: High

Vulnerable Code

yaml

"module": "github.com/ossianhempel/things3-cli/cmd/things@latest",

markdown

- Install (recommended, Apple Silicon): `GOBIN=/opt/homebrew/bin go install github.com/ossianhempel/things3-cli/cmd/things@latest`

Technical Analysis

The installation instructions retrieve and compile things3-cli using the mutable @latest version. Consequently, the installed source code can differ from the version that was present when this skill was reviewed. The installation is not reproducible, and the skill provides no pinned release, commit identifier, or integrity-verification procedure.

This creates a third-party supply-chain risk. If the upstream repository, maintainer account, module publication process, or a future release is compromised, the installation command could retrieve attacker-controlled code. Because go install compiles an executable that users and agents are subsequently instructed to run, malicious upstream changes would gain a direct local execution path.

Attack Path

1. An attacker compromises the upstream repository, maintainer credentials, or release process.
2. The attacker publishes a malicious version that becomes the version resolved by @latest.
3. A user or automated setup process follows SKILL.md and runs:

   sh

   GOBIN=/opt/homebrew/bin go install github.com/ossianhempel/things3-cli/cmd/things@latest
   

4. Go retrieves and compiles the compromised source into the local things executable.
5. The user or agent invokes things for a documented operation.
6. The malicious executable runs with the invoking user's permissions and can access resources available to that execution context.

Impact Assessment

Successful exploitation provides arbitrary code execution with ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, immutable release version or commit, for example:

   sh

   go install github.com/ossianhempel/things3-cli/cmd/things@vX.Y.Z
   

2. Pin the same version in both the metadata installation declaration and the human-readable setup instructions.
3. Review the pinned dependency and its transitive dependencies before approving an update.
4. Document the expected module version and executable checksum where practical.
5. Use an explicit dependency-update process rather than resolving the newest upstream code during installation.
6. Execute the CLI with only the filesystem and environment access required for Things operations.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:33

Finding

Overly Broad Full Disk Access Recommendation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 33
Vulnerability Type: Excessive host-level filesystem permission
Risk Level: Medium

Vulnerable Code

markdown

- If DB reads fail: grant **Full Disk Access** to the calling app (Terminal for manual runs; `OpenClaw.app` for gateway runs).

Technical Analysis

The skill recommends granting macOS Full Disk Access to a general-purpose host application—Terminal or OpenClaw.app—when database reads fail. Full Disk Access is broader than access to the Things database alone and weakens least-privilege isolation for the selected host.

Granting this permission can allow operations performed through that application to reach protected data belonging to unrelated applications and services. For a multi-purpose terminal or agent host, the enlarged permission boundary may apply beyond this individual Things workflow. A compromised dependency, malicious command, or unrelated skill running through the privileged host could therefore benefit from access that was originally granted only to enable Things database reads.

The document does not include a warning explaining this expanded trust boundary, a narrowly scoped alternative, or instructions to revoke the permission after use.

Attack Path

1. Things database reads fail because macOS privacy controls deny access.
2. The user follows the skill instructions and grants Full Disk Access to Terminal or OpenClaw.app.
3. The application subsequently runs the things executable, another skill, or another local command.
4. An attacker compromises one of those executable components or causes the privileged host to perform an unintended file operation.
5. The malicious operation uses the host's expanded authorization to access protected files unrelated to Things.
6. Sensitive information can then be read, altered, or exposed within the limits of the invoking application's effective macOS permissions.

Im

...[truncated 531 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer narrowly scoped access to the Things data directory instead of Full Disk Access wherever macOS permits it.
2. Clearly explain that Full Disk Access applies to the selected host application and may affect commands or workflows unrelated to this skill.
3. Avoid recommending Full Disk Access for a general-purpose Terminal or multi-skill agent host as the default troubleshooting action.
4. Use a dedicated, minimally privileged helper or execution context for database access where feasible.
5. Instruct users to remove the permission after the required operation if persistent access is unnecessary.
6. Keep authentication tokens out of command-line arguments and restrict their exposure to the minimum required process environment.
7. If broad permission is unavoidable, require explicit user confirmation and document the affected data scope before enabling it.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: things-mac
description: Manage Things 3 via the `things` CLI on macOS (add/update projects+todos via URL scheme; read/search/list from the local Things database). Use when a user asks OpenClaw to add a task to Things, list inbox/today/upcoming, search tasks, or inspect projects/areas/tags.
homepage: https://github.com/ossianhempel/things3-cli
metadata:
  {

Static analysis

No suspicious patterns detected.