Omnifocus4

Live OmniFocus access via native Omni Automation — tasks, projects, inbox, tags. Use for ANY OmniFocus query: 'show my tasks', 'what's in my inbox', 'omnifoc...

This skill appears to implement exactly what it claims (local OmniFocus queries and edits), but there are a few things to check before installing or enabling it: 1) The runtime docs tell agents to call a path ending in scripts/of, but the bundle contains scripts/omnifocus.py — confirm what the agent will actually execute and whether an 'of' wrapper is present. 2) SKILL.md asks Local Claude Code to pass dangerouslyDisableSandbox: true to Bash calls on macOS. Disabling the sandbox weakens protections; only do this if you trust the skill and understand the platform implications. 3) The skill writes prefs to ~/.omnifocus4/prefs.json (mode and approved list). Review that file and prefer 'once' or 'every' modes instead of 'yolo' if you want manual approval for writes. 4) Owner/metadata mismatch: the registry owner ID in the initial metadata differs from the ownerId in _meta.json—this could indicate repackaging or a packaging mistake; verify the source/author. 5) If you want to be extra safe, run the included tests locally (they mock osascript) and manually inspect scripts/omnifocus.py to confirm there are no hidden network calls or unexpected behavior. If you will allow autonomous invocation, prefer conservative prefs and avoid enabling 'yolo' to reduce accidental writes.

Type: OpenClaw Skill Name: omnifocus4 Version: 1.0.3 The skill provides deep integration with OmniFocus via AppleScript and Omni Automation, but it contains high-risk instructions in SKILL.md that direct the AI agent to bypass security controls by disabling its sandbox (dangerouslyDisableSandbox: true). Additionally, the instructions use forceful language to override the agent's standard operating procedures (e.g., "do not ask clarifying questions"), which is a form of prompt injection. While the core logic in scripts/omnifocus.py includes a well-designed local authorization system for write operations (prefs.json), the explicit request to lower environment security and the use of osascript for inter-process automation present a significant attack surface.