apple-notes-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the built-in macOS
osascriptutility to execute JavaScript for Automation (JXA) and AppleScript commands. This is the intended mechanism for interacting with the Notes application. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes the body content of Apple Notes, which is external, untrusted data that could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Retrieved note content via
target.body()in the JXA script provided in Step 3. - Boundary markers: Absent. There are no delimiters or specific instructions provided to the agent to treat the retrieved note body as untrusted data.
- Capability inventory: The skill allows file system modification (Read, Write, Edit) and shell execution via
osascriptwithin theBashtool. - Sanitization: Absent. The retrieved HTML body is passed directly into the agent's context without filtering or escaping.
Audit Metadata