The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and transform content from Apple Notes, which serves as an external, untrusted data source. Malicious instructions embedded within a note could potentially be executed by the agent during automated processing tasks.
Ingestion points: User-generated note content is read via n.body() and n.plaintext() calls within AppleScript (JXA) execution blocks in SKILL.md.
Boundary markers: The documentation explicitly instructs the user to sanitize content and minimize fields, but no formal delimiters or "ignore instructions" tags are programmatically enforced in the provided scripts.
Capability inventory: The skill has access to Read, Write, and Bash tools, enabling it to access local files and execute system commands based on processed data.
Sanitization: The notesHtmlToMarkdown function uses basic regular expressions for conversion, which may not be sufficient to sanitize complex or adversarial HTML content.
[COMMAND_EXECUTION]: The skill utilizes osascript to interface with the macOS Notes application and the local filesystem.
Evidence: Shell scripts in SKILL.md execute osascript -l JavaScript to iterate through the user's default account notes, extracting sensitive metadata and bodies to JSON files in the user's home directory.

apple-notes-data-handling