apple-notes-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill relies on an external CLI tool installed from a personal Homebrew tap ('antoniorodr/memo'), representing a third-party dependency from a non-trusted source.
- [COMMAND_EXECUTION]: The agent executes shell commands using the 'memo' binary to interact with the macOS Apple Notes database, which requires granting Automation permissions.
- [PROMPT_INJECTION]: The 'Security Guardrails' section provides specific instructions to influence agent behavior regarding confirmation logic and social engineering, modifying the agent's decision-making framework.
- [PROMPT_INJECTION]: Reading note contents creates a surface for indirect prompt injection.
- Ingestion points: Note bodies are ingested into the prompt via search and list commands.
- Boundary markers: Absent; note contents are interpolated without delimiters to differentiate untrusted data from instructions.
- Capability inventory: The agent can create, edit, move, and delete notes via the CLI.
- Sanitization: No sanitization of note content is performed before presentation to the agent.
Audit Metadata