The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an ingestion point for untrusted data by reading content and metadata from Apple Notes via osascript and Apple Shortcuts.
Ingestion points: The list, count, and folders commands in scripts/notes-cli.sh and SKILL.md ingest data from the local Notes database.
Boundary markers: The skill does not implement delimiters or specific instructions to the agent to ignore potentially malicious instructions embedded within the notes.
Capability inventory: The skill utilizes Read, Write, Edit, and Bash capabilities, which could be misused if the agent obeys instructions found within note content.
Sanitization: No sanitization or filtering is applied to the output of the automation scripts before it is processed by the agent.
[DATA_EXFILTRATION]: The skill is designed to access and display sensitive personal information stored in Apple Notes.
The list functionality in the wrapper script explicitly retrieves note titles and IDs.
The skill documentation warns that using these tools can expose note metadata in terminal history and logs, which may be accessible to other processes or users on the system.
[COMMAND_EXECUTION]: The skill makes extensive use of the osascript command to execute AppleScript and JavaScript for Automation (JXA) payloads, which is the standard method for macOS inter-process communication but represents a powerful execution capability.

apple-notes-install-auth