things-mac
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
things3-clitool from a third-party repository (github.com/ossianhempel/things3-cli) using the Go package manager. This is necessary for the skill's primary function. - [COMMAND_EXECUTION]: The skill interacts with the macOS system and the Things 3 application by executing the
thingscommand-line utility. This includes reading from the local SQLite database and triggering macOS URL schemes to create or modify tasks. - [DATA_EXPOSURE]: To function, the tool requires access to the user's local Things 3 database (located in the
ThingsData-*folder). This database contains task content, notes, and project metadata. The skill instructions note that 'Full Disk Access' must be granted to the application for this to work.
Audit Metadata