omnifocus-2
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes OmniFocus task data, such as names and notes, which serves as a potential vector for indirect prompt injection if the data contains malicious instructions targeted at the agent.
- Ingestion points: Task names and notes are retrieved from the OmniFocus application via
scripts/list_tasks.jsandscripts/search_tasks.jsand returned to the agent in JSON format. - Boundary markers: The skill instructions do not define clear delimiters or provided warnings to the agent to treat task content as potentially untrusted data or to ignore embedded instructions.
- Capability inventory: The presence of tools that can modify application state, including
scripts/add_task.js,scripts/complete_task.js, andscripts/update_task.js, increases the potential impact of a successful injection. - Sanitization: There is no implementation of content sanitization or validation to filter out potential instructions from task data before ingestion.
Audit Metadata