The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the things3-cli binary from a third-party GitHub repository (github.com/ossianhempel/things3-cli/cmd/things@latest) using the go install command. This involves downloading and executing code from an external source not belonging to the author or a trusted organization.
[COMMAND_EXECUTION]: The core functionality of the skill relies on executing the things CLI tool to perform database reads and URL scheme writes. This includes potentially sensitive operations like updating tasks using an authentication token.
[DATA_EXFILTRATION]: The skill explicitly instructs the agent to read from the local Things 3 database (ThingsData-*), which contains sensitive user data such as private tasks, projects, notes, and tags. It also requests the user to grant "Full Disk Access" to the application, which significantly expands the skill's data access scope on the system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from a local database containing user-controlled content (Category 8).
Ingestion points: Reads task titles, notes, and project names from the local ThingsData-* folder.
Boundary markers: No delimiters or safety warnings are present to distinguish between task data and instructions.
Capability inventory: Executes shell commands via the things CLI, performs database queries, and triggers URL schemes.
Sanitization: No validation or sanitization of the database content is performed before the agent processes it.

things-mac