Things plus

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:55 AM UTC
• Version: 1.2.1

Overview

The skill is a coherent Things 3 task-manager integration, but it can write persistent tasks from broad conversational cues without confirmation and relies on an unpinned third-party CLI install.

Install only if you are comfortable letting the agent read and modify your Things database. Before using it broadly, prefer changing the behavior to confirm inferred captures, pin or review the things3-cli install source, and avoid granting Full Disk Access unless a specific operation truly needs it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25
Vulnerability Type: Unpinned third-party dependency from a non-core Homebrew tap
Risk Level: Medium

Vulnerable Code:

bash

brew install ossianhempel/tap/things3-cli

Technical Analysis

The documented installation command retrieves things3-cli from the third-party Homebrew tap ossianhempel/tap without pinning an immutable release, formula commit, artifact checksum, or other integrity-verification value.

Homebrew formulas control the source artifacts and installation or build steps performed on the user's system. Because this command follows the tap's mutable current state, the executable and installation logic obtained by a future user may differ from what was available when this Skill was audited. A compromised maintainer account, repository, formula, release asset, or upstream distribution could therefore introduce malicious code through the documented setup process.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, the referenced upstream release, or another relevant supply-chain component.
2. The attacker modifies the formula or distributed artifact to contain malicious installation logic or executable code.
3. A user follows the Skill's setup instruction and runs:

   bash

   brew install ossianhempel/tap/things3-cli
   

4. Homebrew retrieves the mutable, attacker-controlled package definition or artifact.
5. Malicious code executes during installation or when the Agent later invokes the apparently legitimate things command.
6. The code acts with the privileges and data access available to the installing user and the Agent's execution context.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. The affected scope could include local Things 3 records, files readable by the user, and environment variables available ...[truncated 432 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed, immutable release or formula commit rather than installing the latest mutable version.
• Document the authoritative source repository, expected version, and cryptographic checksum of the reviewed artifact.
• Verify downloaded artifacts against a trusted checksum or signature before installation.
• Prefer an official, reproducible distribution channel where available.
• Review formula changes before upgrades and require explicit approval for dependency-version changes.
• Run the CLI with the minimum permissions needed and avoid exposing unrelated credentials in its environment.
• Grant Full Disk Access only when local database access demonstrably requires it, and revoke that permission when it is no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger definition is intentionally very broad and includes ordinary personal planning phrases like 'I should', 'remind me to', and 'don't let me forget', which can cause the skill to activate on casual conversation rather than explicit task-management requests. In this skill's context, activation is especially risky because the default behavior is to write directly to the user's Things database, so over-triggering can produce unintended data creation or modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The skill is designed to persist user statements into a long-lived external task database and defaults to attempting writes immediately. In context, this creates a real session-persistence risk because transient conversation content can be converted into durable records without an explicit checkpoint, increasing the chance of storing mistaken, sensitive, or context-only information.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

Do NOT trigger for: hypothetical examples, quoted text, brainstorming about someone else's tasks, or vague general discussion without clear personal action intent.

Execution default: attempt writes directly; escalate to environment or auth checks only when a write actually fails.

metadata:
  openclaw:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs direct writes by default but does not require a clear user-facing notice that data will be created or modified in Things. That creates a transparency and consent problem: users may think they are discussing plans, while the agent interprets that as permission to persist tasks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

Use the `things` CLI to read from and write to the local Things 3 database.

**Credential policy:** `THINGS_AUTH_TOKEN` may be required for some operations in some environments (for example, certain update paths). Verify token presence via `things auth`; do not ask the user to paste it into chat.

## Setup

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The instruction to treat planning phrases as capture intent and 'add directly without asking for confirmation' delegates consequential write decisions to the agent. In a personal task manager, this can lead to unauthorized or mistaken task creation, task splitting, and scheduling decisions based on imperfect inference from natural language.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

## Strategy layer

- Treat concrete personal planning phrases as capture intent; add directly without asking for confirmation
- For ambiguous intent (hypotheticals, someone else's plans, general discussion) — do not capture
- When the user mentions multiple distinct future actions in one message, split them into separate tasks unless they clearly belong to a single bundled action
- Use Things' native **Today / Upcoming / Anytime / Someday** views; do not invent extra taxonomy

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt instructs the agent to delete all tasks, recurring items, projects, and tags created during the test run, and to retry deletions until nothing remains, but it provides no user-facing warning or confirmation step before destructive actions. In a task-management skill, this is dangerous because cleanup logic can misidentify items as test-created or act on ambiguously matched existing objects, causing unintended data loss in the user's real Things database.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.