The Agent Skills Directory

[COMMAND_EXECUTION]: The shell script markdown-to-notes.sh performs unsafe interpolation of file content into an osascript execution string. The contents of Markdown files are read and placed directly inside a JavaScript template literal (using backticks) without escaping. This allows a user-provided or attacker-controlled Markdown file containing backticks or ${} expressions to escape the string context and execute arbitrary JavaScript code within the JXA environment.
[DYNAMIC_EXECUTION]: The skill uses string concatenation to assemble and execute code at runtime. Specifically, it builds a JavaScript payload from local file data and executes it using osascript. This dynamic code generation lacks proper sanitization or parameterization, leading to code injection risks when processing external files.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Markdown files and its instructions suggest syncing from RSS or calendars, creating a risk surface for indirect injection.
Ingestion points: markdown-to-notes.sh reads all *.md files in the current directory.
Boundary markers: No technical boundary markers or "ignore instructions" delimiters are implemented in the scripts to isolate data from logic.
Capability inventory: The skill can execute shell commands via osascript, modify the Apple Notes database, and read/write local files.
Sanitization: The script only applies basic Markdown-to-HTML formatting via sed and lacks security-focused sanitization to prevent code or instruction injection into the JXA runtime.

apple-notes-core-workflow-a