apple-notes-performance-tuning

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill patterns involve the agent ingesting and processing data from Apple Notes, which could contain untrusted content.
  • Ingestion points: The skill reads full note bodies and plaintext content via osascript in Strategy 2 and Strategy 3.
  • Boundary markers: No explicit delimiters or boundary markers are suggested in the code examples to distinguish between automation instructions and note data.
  • Capability inventory: The skill requests Bash(osascript:*) and Write permissions to perform note extraction and local file management.
  • Sanitization: While the examples use standard serialization (JSON, CSV), they do not include mechanisms to sanitize the content for potential prompt injection attacks.
  • [DATA_EXFILTRATION]: The skill facilitates the transfer of note content from the secure Apple Notes environment to the local file system.
  • Data Exposure: Note content, including plaintext and metadata, is exported to a local SQLite database at $HOME/.notes-cache.db and state files like .notes-last-sync.
  • Security Controls: The skill documentation notes the necessity of private, encrypted caches and redaction controls to protect the sensitive data being duplicated.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to interact with system applications.
  • Evidence: The Strategy 3 example utilizes execSync in TypeScript to execute osascript for note retrieval, and Strategy 2 uses a bash script to pipe osascript output into sqlite3.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:44 AM
Security Audit — agent-trust-hub — apple-notes-performance-tuning