The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to run pip install apple-notes-to-sqlite to facilitate database exports. This package is from a third-party maintainer and is installed without version pinning, which can lead to the installation of untrusted or modified code if the package is compromised.
[REMOTE_CODE_EXECUTION]: The installation of the apple-notes-to-sqlite package via pip involves the execution of remote scripts during the installation process, constituting a remote code execution vector from a non-whitelisted source.
[COMMAND_EXECUTION]: The skill uses osascript (JavaScript for Automation) to programmatically interface with the macOS Notes application. This allows the skill to read sensitive user information, including the full text of all notes, their titles, folder organization, and timestamps.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the user's Apple Notes database, which could contain malicious instructions designed to influence the agent's behavior during the export or conversion process.
Ingestion points: The skill reads note content and metadata through Application("Notes") in several osascript code blocks in SKILL.md (Steps 1, 2, 3, and 4).
Boundary markers: There are no boundary markers or delimiters used to separate the ingested note content from the instructions being followed by the agent.
Capability inventory: The skill has access to package management (pip), system automation (osascript), file system writes (mkdir, >), and database utilities (sqlite3).
Sanitization: Sanitization is limited to basic filename cleaning (replacing / and :) and primitive HTML tag stripping via sed. No robust validation or escaping is applied to the note content before it is processed or written to disk.

apple-notes-core-workflow-b