The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/omnifocus.js uses currentApp.doShellScript to execute dynamically generated AppleScript via the osascript command-line utility. This pattern is used for tag and repetition management to circumvent limitations in JavaScript for Automation (JXA).
[COMMAND_EXECUTION]: Multiple commands (tag, untag, repeat, unrepeat) in scripts/omnifocus.js interpolate the taskId variable directly into AppleScript strings without sanitization or escaping. Because these strings are then executed as code, a crafted Task ID containing quotes and line breaks (e.g., abc" end tell end tell ...) could be used to break out of the intended logic and execute arbitrary AppleScript or system commands on the macOS host.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external application (OmniFocus) which creates an attack surface for indirect prompt injection.
Ingestion points: Task names, notes, and project names are retrieved in scripts/omnifocus.js via the inbox, tasks, today, search, and info commands.
Boundary markers: The skill does not implement delimiters or instructions to ignore embedded commands within the retrieved task data.
Capability inventory: The skill possesses capabilities to modify the file system (via AppleScript), delete tasks, and rename projects as seen in scripts/omnifocus.js.
Sanitization: There is no sanitization or filtering of the content retrieved from OmniFocus before it is presented to the agent.

omnifocus