The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a binary using go install github.com/ossianhempel/things3-cli/cmd/things@latest. This downloads and compiles code from a repository outside of trusted organizations or well-known service providers.
[COMMAND_EXECUTION]: The skill relies on executing the things CLI to perform all operations, including reading the database and adding tasks. The installation path /opt/homebrew/bin is used for the binary.
[DATA_EXPOSURE]: The skill accesses the local Things 3 database (typically found in ThingsData-* folders) which contains personal tasks, notes, and project details. The documentation explicitly asks for 'Full Disk Access' to be granted to the calling application to read these files.
[CREDENTIALS_UNSAFE]: The skill mentions the use of THINGS_AUTH_TOKEN for update operations. While it suggests using environment variables, the instructions also show passing tokens via CLI flags (--auth-token <TOKEN>), which may expose secrets in process lists or shell history.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an external source (the Things database).
Ingestion points: Commands like things inbox and things search pull user-generated content into the agent's context.
Boundary markers: None are specified to separate database content from instructions.
Capability inventory: The agent can execute shell commands via the things CLI.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from the database before it is processed by the agent.

things-mac