The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts responsible for creating events and reminders are vulnerable to command injection because they use unquoted here-docs to pass data to the macOS AppleScript interpreter.
Ingestion points: Untrusted user input (natural language text or data extracted from screenshots) is processed by the AI and passed directly as arguments to the scripts/create_event.sh and scripts/create_reminder.sh scripts.
Sanitization: The esc() function defined in the scripts only escapes double quotes ("). It does not sanitize other shell metacharacters such as backticks (`), dollar signs ($), or command substitution syntax ($()).
Vulnerability Detail: Variables like TITLE, LOC, and NOTES are interpolated into an unquoted here-doc block (<<APPLESCRIPT). In bash, content in unquoted here-docs undergoes variable and command expansion. If the user-provided data contains backticks or command substitution operators, the shell executing the script will run those commands before passing the resulting string to AppleScript.
Capability inventory: The vulnerability allows arbitrary command execution with the privileges of the local user and the terminal app that was granted permission to control the Calendar and Reminders apps.
[REMOTE_CODE_EXECUTION]: The command injection vulnerability identified allows for arbitrary code execution. Although the input originates from a user prompt, a malicious prompt injection can exploit this vulnerability to execute system commands, potentially leading to unauthorized data access or system modification.

apple-smart-schedule