things-mac
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
things3-clitool directly from a GitHub repository (github.com/ossianhempel/things3-cli/cmd/things@latest) using the Go package manager. This source is not among the predefined trusted organizations. - [COMMAND_EXECUTION]: The skill relies on executing the
thingsbinary to interact with the local Things 3 application. It also provides examples of piping multi-line input from STDIN to the command. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in task data.
- Ingestion points: Data is pulled into the agent's context through commands that read the local database, such as
things inbox,things search, andthings projects(found inSKILL.md). - Boundary markers: There are no instructions or delimiters provided to the agent to treat the database output as untrusted data.
- Capability inventory: The agent has the capability to write back to the system using
things addandthings update(found inSKILL.md). - Sanitization: No sanitization or validation of the retrieved database content is performed before it is processed by the agent.
Audit Metadata