The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the things CLI tool from a non-trusted GitHub repository (github.com/ossianhempel/things3-cli) using the go install command during the installation phase.
[COMMAND_EXECUTION]: Relies on the execution of the things binary to interact with the local Things 3 database and perform write operations via macOS URL schemes.
[DATA_EXFILTRATION]: Accesses the local Things 3 database folder (ThingsData-*), which contains sensitive personal tasks, notes, and project metadata. Although no outbound network requests were identified in the skill instructions, the third-party binary has access to this data.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection. 1. Ingestion points: The agent ingests external data from the local Things database through commands like things inbox, things today, and things search. 2. Boundary markers: No delimiters or clear instructions are used to distinguish retrieved task data from system instructions. 3. Capability inventory: The skill can execute shell commands to add or update tasks (things add, things update). 4. Sanitization: There is no evidence of validation, escaping, or filtering of the content retrieved from the database before it is processed by the agent.

things-mac