apple-notes

Warn

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the memo CLI tool from a non-standard third-party Homebrew tap (antoniorodr/memo/memo). This introduces a dependency on unvetted external code that accesses the user's private Apple Notes database.
  • [COMMAND_EXECUTION]: The skill's functionality is built around executing shell commands via the memo binary to perform operations like searching, listing, and modifying notes.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes user-controlled content from Apple Notes without sanitization.
  • Ingestion points: Note data is retrieved into the agent context via memo notes and fuzzy search commands in SKILL.md.
  • Boundary markers: No delimiters or safety instructions are used to distinguish note content from system instructions.
  • Capability inventory: The agent can create, modify, and delete notes using the memo tool as described in SKILL.md.
  • Sanitization: The skill does not implement any validation or filtering of the retrieved note content.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 14, 2026, 12:14 AM
Security Audit — agent-trust-hub — apple-notes