The Agent Skills Directory

[DYNAMIC_EXECUTION]: The provided NotesClient TypeScript example uses string interpolation to build JXA scripts that are executed via osascript. The create method inserts title and body directly into JXA string literals: const n = Notes.Note({name: "${title}", body: "${body}"});. This is highly vulnerable to JXA injection; a note title containing a double quote followed by JavaScript commands would be executed by the Apple Events bridge with the user's permissions.
[COMMAND_EXECUTION]: The skill utilizes child_process.execSync to run shell commands (osascript). While the code attempts to escape single quotes to prevent shell injection, it does not address the logic injection within the JXA payload itself, potentially leading to arbitrary command execution on the host macOS system.
[PERSISTENCE]: The architecture explicitly includes and recommends the use of launchd for deployment, citing an install.sh script and a launchd.plist template. This is a standard persistence mechanism on macOS that allows scripts to run automatically and should be carefully audited in production environments.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from Apple Notes, which acts as an untrusted ingestion surface.
Ingestion points: Data enters the system via Notes.app content (note titles, bodies, and folder names) accessed by the NotesClient.
Boundary markers: The instructions recommend placing validation "above the JXA adapter," but no specific boundary markers or "ignore" instructions are present in the core logic example.
Capability inventory: The skill has the capability to execute shell commands and control other macOS applications via the JXA bridge.
Sanitization: The code lacks sanitization for JXA control characters (e.g., double quotes, backslashes) when interpolating note data into script strings.

apple-notes-reference-architecture