apple-notes
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves contents from Apple Notes, which represents an attack surface for indirect prompt injection if notes contain shared content or text clipped from malicious web pages.
- Ingestion points: Untrusted external data enters the agent context via
scripts/read-note.sh(retrieving the full HTML body) andscripts/list-attachments.sh(retrieving OCR summaries). - Boundary markers: Absent. The scripts output raw text and HTML data directly to the console without any protective boundary delimiters or structural isolation.
- Capability inventory: The skill is strictly read-only and contains no file-write or network-exfiltration capabilities of its own, though it operates within the broader context of an active agent platform.
- Sanitization: Absent. No filtering, validation, or escaping is performed on the note text or attachment summaries before they are processed by the agent.
Audit Metadata