apple-notes

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This URL points to a personal GitHub repository that the scripts clone to fetch deployable worker code (an unvetted third‑party source used to deliver executable code), posing a supply‑chain risk and matching high‑risk indicators for GitHub-hosted downloads from unknown accounts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text from the user via $ARGUMENTS and, in the no-args case, “scan the recent conversation” to infer title/body and then confirms via AskUserQuestion before creating—so outsider text is LLM-readable without first selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes setup scripts that clone and pull executable Worker source from a remote GitHub repo (https://github.com/FradSer/apple-sync-kit.git), which is fetched during installation and then used to run/install/deploy code (pnpm install / wrangler deploy), so this external URL enables fetching and executing remote code required for cloud sync.