apple-notes
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a third-party Homebrew tap ('antoniorodr/memo') and a Python-based utility to enable functionality.
- [COMMAND_EXECUTION]: The skill performs various shell operations using the 'memo' CLI tool, including listing, searching, creating, and deleting content on the local system.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes untrusted data from Apple Notes which could contain hidden instructions for the agent.
- Ingestion points: Note content and search results are ingested into the agent context via 'memo notes' and 'memo notes -s'.
- Boundary markers: Absent. The instructions do not define delimiters or protective wrapping to distinguish between note data and agent instructions.
- Capability inventory: The skill possesses the ability to modify the local environment by creating, editing, and deleting notes via 'memo' subprocess calls.
- Sanitization: Absent. There is no evidence of filtering or sanitization performed on the content retrieved from the Notes application before it is processed by the agent.
Audit Metadata