OmniFocus

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:20 AM UTC
• Version: 1.0.0

Overview

This skill transparently manages OmniFocus tasks on the user's Mac and its read/write access is expected for that purpose.

Install this only if you want Clawdbot to access your live OmniFocus database. Ask it to show matching tasks before completing or updating anything, especially when task names are similar, and avoid listing/searching notes if your OmniFocus contains sensitive personal or work information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent

Content

```

**Key Scripts:**
- `add_task.js` - Add task to inbox
- `list_tasks.js` - List tasks with filters
- `search_tasks.js` - Search tasks by keyword
- `complete_task.js` - Complete a task by name

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide documents a destructive command that marks tasks complete by name and explicitly notes it completes the first match, but it does not warn that this mutates user data and may affect the wrong task when names are ambiguous. In an agent-driven context, that omission increases the chance of unintended state changes in a personal task system through user misunderstanding or overly broad automation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The update command can alter existing task notes, due dates, and flags, yet the documentation presents it as routine usage without warning about data modification or accidental overwrite. In a skill intended for automated agent use, this can lead to silent corruption of task metadata or unintended workflow changes if the wrong task is selected or arguments are misparsed.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env osascript -l JavaScript

// Add a task to OmniFocus inbox
// Usage: osascript -l JavaScript add_task.js "Task name" ["Note text"] ["Due date YYYY-MM-DD"]

function run(args) {

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env osascript -l JavaScript

// Add a task to OmniFocus inbox
// Usage: osascript -l JavaScript add_task.js "Task name" ["Note text"] ["Due date YYYY-MM-DD"]

function run(args) {

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script serializes and returns task notes, project names, tags, due dates, and stable task IDs for every matched OmniFocus task without any minimization, redaction, or explicit user disclosure. Task notes often contain sensitive personal or work information, so broad export to the calling agent increases the risk of unintended data exposure beyond what is necessary for many listing use cases.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This is a markdown file, so SQP-2 applies to omitted warnings in documentation. The examples create an inbox task and modify task properties, but the document does not warn readers that running these snippets will write to their actual OmniFocus database rather than a sandbox or read-only context.

Static analysis

No suspicious patterns detected.