The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a test helper function that is vulnerable to JXA injection, potentially allowing arbitrary code execution within the context of the Notes application.
Ingestion Point: The title parameter in the createTestNote function within SKILL.md accepts arbitrary string input.
Boundary Markers: None present. The input is processed as part of a raw script string.
Capability Inventory: The skill utilizes execSync to run osascript, which can control system applications and access local data.
Sanitization: None. The code uses template literals to insert the title directly into a JavaScript string passed to osascript (name: "${title}"). An attacker could provide a payload that breaks out of the string quotes to execute unauthorized JXA commands.
[DYNAMIC_EXECUTION]: The skill relies on the dynamic generation and execution of scripts.
In src/dev/watch-runner.ts, the skill monitors a local directory and automatically executes any changed .js files via osascript whenever they are saved.
In src/dev/test-notes.ts, the runJxa function assembles and executes JXA script strings at runtime using execSync.
[COMMAND_EXECUTION]: The skill uses child_process.execSync to execute shell commands, specifically invoking the macOS osascript utility. This allows the skill to programmatically interact with system applications, which, if misused, could lead to unauthorized data access or system modification.

apple-notes-local-dev-loop