The Agent Skills Directory

[COMMAND_EXECUTION]: The AppleNotesClient.runJxa method in SKILL.md executes shell commands via child_process.execSync using string interpolation. The implementation uses a simple single-quote escape script.replace(/'/g, "\\'") which is insufficient to prevent command injection in all shell environments, especially if inputs contain backticks or dollar signs.
[DYNAMIC_EXECUTION]: The skill demonstrates patterns for dynamically generating JavaScript for Automation (JXA) code. Methods such as listNotes, createNote, and searchNotes interpolate variables directly into the JXA script string. For example, the searchNotes method uses const q = "${query}", which allows a malicious input to break out of the string literal and execute arbitrary JXA code.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where untrusted data (folder names, search queries, and note contents) is processed and passed to high-privilege execution tools.
Ingestion points: Input parameters for listNotes, createNote, and searchNotes functions in src/notes-client.ts.
Boundary markers: The skill includes textual instructions to treat inputs as data, but the provided code implementation lacks programmatic boundary markers or secure delimiters.
Capability inventory: The skill utilizes execSync to interact with the macOS system via the osascript tool.
Sanitization: The sanitization logic is limited to a single character replacement and does not provide robust protection against script-level or shell-level injection.

apple-notes-sdk-patterns