The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Installs the things3-cli tool from a third-party GitHub repository (github.com/ossianhempel/things3-cli) via the go install command defined in the skill's metadata.
[COMMAND_EXECUTION]: Executes the things command-line utility to perform queries against the local database and to trigger URL-scheme updates to the Things 3 application.
[CREDENTIALS_UNSAFE]: Manages a THINGS_AUTH_TOKEN for write operations. While the instructions suggest environment variable storage, the agent still processes this sensitive secret for task updates.
[DATA_EXFILTRATION]: Accesses the private Things 3 database (ThingsData-*), which contains sensitive personal tasks and project metadata. The skill instructions require the user to grant "Full Disk Access" to facilitate these reads.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it reads and searches task content that could contain malicious instructions.
Ingestion points: Processes data from the local database via things inbox, things today, and things search commands.
Boundary markers: No explicit markers are used to separate untrusted task content from the agent's internal instructions.
Capability inventory: The agent can modify existing tasks and create new ones using the things update and things add commands.
Sanitization: No validation or sanitization of task content is performed before it is ingested into the context.

things-mac