apple-notes-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accesses untrusted data by reading the content of the user's Apple Notes via the
n.body()method in JXA scripts. - Ingestion points: Several scripts in
SKILL.mdprogrammatically fetch note text and metadata from the local Notes database. - Boundary markers: There are no explicit delimiters or specific instructions for the agent to treat the ingested note content as data rather than instructions.
- Capability inventory: The skill is granted
Bash,Write, andEditpermissions, enabling it to interact with the local filesystem and system services. - Sanitization: The skill lacks mechanisms to sanitize or filter potential malicious instructions embedded within notes before processing them.
- [COMMAND_EXECUTION]: The skill executes shell commands and JavaScript for Automation (JXA) via
osascript. While these are standard tools for its stated purpose of macOS automation, they provide a broad interface for interacting with local applications and sensitive user data.
Audit Metadata