OmniFocus Automation

Manage OmniFocus tasks, projects, and folders via Omni Automation. Use for task management, to-do lists, project tracking, GTD workflows, adding/completing/editing tasks, setting due dates, managing tags, and recurring tasks. Requires OmniFocus installed on macOS.

This skill appears to do what it says: control OmniFocus via macOS automation. Before installing or running it, review the full scripts (scripts/omnifocus.js) yourself or have someone you trust inspect them. Pay attention to the AppleScript snippets executed via doShellScript/osascript (those can run shell commands). Only grant macOS Automation permissions to this script if you trust the source. Note that the package has no homepage and an unknown source/owner — lack of provenance increases risk; prefer skills from known authors or with a public repo you can inspect. If you need extra safety, run the script on a machine/profile with limited data or copy your OmniFocus data for backup before use.

Type: OpenClaw Skill Name: omnifocus-automation Version: 1.0.0 The `scripts/omnifocus.js` file uses `doShellScript` to execute AppleScript for certain operations (e.g., `tag`, `untag`, `repeat`). While `tagName` is properly escaped for AppleScript string literals, the `taskId` argument is embedded directly into the AppleScript string without escaping. This creates an AppleScript injection vulnerability, allowing an attacker to craft a malicious `taskId` that could execute arbitrary shell commands via AppleScript's `do shell script` command. This capability, while not explicitly malicious in its current form, provides a direct path to arbitrary code execution if the agent can be prompted to use a specially crafted `taskId`.